Linux sort Command Guide: Rank Attacker IPs in Seconds

Linux sort Command Tutorial: 20+ Practical Examples for SOC Analysts and Log Analysis

Quick Answer: The Linux sort command orders text lines by alphabet, number, size, or column. Paired with uniq, it turns raw logs into ranked lists of top attacker IPs, noisy processes, and large files in seconds.

Examples in this guide target GNU coreutils sort, the default on most Linux distributions. BSD and macOS versions differ slightly on some flags.

Picture this composite scenario, typical of what SOC teams see. It is 2:47 AM and an alert says a public-facing Linux server has an unusual number of failed SSH logins. You open the authentication log and find tens of thousands of lines. Your SIEM connector is lagging, and your manager wants one answer: which IP addresses are hammering this box? This is where Linux log analysis with the humble sort command earns its keep. Nothing to install, nothing to configure, and an answer in one line.

Most tutorials treat sort as a way to alphabetize a grocery list. In a real investigation it is the step that turns a wall of text into a ranked list you can act on. Below are the essential flags, the mistakes that trip up even experienced admins, and the workflows analysts actually use.

Table of Contents

• Why sort Matters in Security Work
• Basic Sorting: Alphabetical, Reverse, and Unique
• Numeric, Human-Readable, and IP Address Sorting
• Sorting by Column and Custom Delimiter
• Sorting Command Output: Files, Time, and Processes
• sort and uniq: The Frequency-Count Pattern
• Real-World SOC Workflows
• Detection and Prevention Takeaways
• Expert Tips for Faster, Safer Sorting
• Quick Reference Table
• FAQ
• Conclusion

Why sort Matters in Security Work

Security data is mostly repetition. The same IP shows up hundreds of times, the same user agent appears in every request, the same process runs on every host. Patterns hide in that repetition, and sort is the fastest way to expose them. Sorting is also a prerequisite for other tools: uniq only collapses adjacent duplicates, and comm requires sorted input.

By default, sort compares whole lines using your locale's collation rules. That detail matters more than most people expect, and we will come back to it in the expert tips section.

Basic Sorting: Alphabetical, Reverse, and Unique

Basic and reverse sort

sort file.txt
sort -r file.txt

The first command sorts lines alphabetically. The second reverses the order. Use these to normalize lists such as usernames, hostnames, or domain watchlists before comparing or deduplicating them.

Case-insensitive sort

sort -f file.txt

The -f flag folds lowercase to uppercase during comparison, so "Admin" and "admin" are treated as equal. This is useful when usernames or hostnames arrive in mixed case from different log sources.

Unique sort

sort -u file.txt

This sorts and removes duplicate lines in one pass. Expected output is the sorted list with each distinct line appearing once.

Save the sorted output

sort file.txt > sorted.txt

This writes the result to sorted.txt. Sorting to a new file leaves the original untouched.

Warning: do not redirect output back into the input file. Running sort file.txt > file.txt makes the shell truncate file.txt before sort reads it, and you end up with an empty file. To sort in place, use the built-in output flag:

sort -o file.txt file.txt

Numeric, Human-Readable, and IP Address Sorting

Numeric sort

sort -n numbers.txt
sort -nr numbers.txt

Without -n, the text "100" sorts before "9" because "1" comes before "9" character by character. With -n, values are compared by numeric value. Add r for highest-to-lowest. The second form, -nr, is the workhorse of "show me the top offenders" one-liners.

Human-readable sizes

sort -h sizes.txt

The -h flag understands suffixes such as K, M, and G, so 10K, 2M, and 1G sort in true size order. Plain -n would get this wrong. A practical use is finding what is eating disk space, for example when investigating a suspicious archive in a temp directory:

du -sh /tmp/* | sort -rh | head -10

This lists the ten largest items under /tmp, biggest first. It only reads sizes and changes nothing.

Sorting IP addresses

sort -V ip.txt

Version sort (-V) compares the numeric chunks inside each line, so 10.0.0.2 lands before 10.0.0.10, which plain alphabetical sorting gets wrong. It works well for dotted IPv4 lists on GNU systems. If you want an explicit, portable approach, sort each octet numerically:

sort -t. -k1,1n -k2,2n -k3,3n -k4,4n ip.txt

Here -t. sets the period as the field separator, and each -k sorts one octet numerically in order.

Sorting by Column and Custom Delimiter

Sort by a column

sort -k2 file.txt

By default, fields are separated by whitespace. This sorts on the second field. There is a classic gotcha here: -k2 means "from field 2 to the end of the line," so later fields can affect the ordering. To sort on field 2 only, specify the end of the key:

sort -k2,2 file.txt

Sort by multiple columns

sort -k1,1 -k2,2 file.txt

This sorts by column 1 first, then breaks ties using column 2. It is handy for grouping events by host and then by username.

Numeric or reverse order on a specific column

sort -k2,2n data.txt
sort -k3,3r data.txt

You can attach modifiers to a key. The first sorts column 2 numerically, and the second sorts column 3 in reverse. Attaching the modifier to the key keeps it from affecting other columns.

Custom delimiter for CSV data

sort -t',' -k3 file.csv
sort -t',' -k3,3n data.csv

The -t flag sets the delimiter. The first command sorts a CSV by its third field as text, and the second sorts by the third field numerically. Note that sort is not a real CSV parser. If a field contains a quoted comma, the column count shifts and your results will be wrong. For messy exports, use a proper CSV tool first.

Sorting Command Output: Files, Time, and Processes

Sort ls output by file size

ls -lh | sort -k5,5h

In ls -l output, size is the fifth column. This sorts the listing by the human-readable size. You can also let ls do the work with ls -lhS, which lists largest first.

Sort by modification time

ls -lt
ls -ltr

To be precise, these use ls's own sorting, not the sort command. ls -lt puts the newest modified files first, and ls -ltr reverses that so the oldest come first. During an incident, ls -lt on a web root or user home directory is a quick way to spot files that changed recently. Treat it as a lead, not proof, because modification times can be altered.

Rank processes by CPU usage

ps aux | sort -k3,3nr | head -10

Column 3 of ps aux is CPU percentage, so this shows the ten busiest processes, highest first. Unexplained high-CPU processes, especially under unusual users or odd paths, deserve a closer look. On systems with procps-ng, ps aux --sort=-%cpu | head does the same job natively.

sort and uniq: The Frequency-Count Pattern

sort file.txt | uniq

This sorts the file and then removes consecutive duplicate lines. Sorting first is essential because uniq only compares neighboring lines. For whole-line deduplication, this is equivalent to sort -u file.txt. One subtle difference: when you combine -u with -k, sort treats lines as duplicates if their keys match, even when other fields differ.

The real power comes from adding uniq -c, which prefixes each line with its count, and a second sort to rank the results:

sort file.txt | uniq -c | sort -nr | head -20

Read it as "sort, count the duplicates, then rank by count, highest first." Once you memorize this pattern, you will use it almost daily.

Real-World SOC Workflows for Brute-Force Attack Detection and Triage

Rank failed SSH logins by source IP

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -10

This filters failed password lines, extracts the source IP (the fourth field from the end in standard OpenSSH log lines), counts each unique address, and shows the top ten. Expected output is a list such as 412 203.0.113.45, where the number is the failure count. On RHEL-family systems, the log is usually /var/log/secure. On systems that log only to the journal, pipe from journalctl -u ssh --no-pager instead (the unit is often named sshd on RHEL-family distributions). Always confirm the field position against a sample line, since log formats vary.

Find the busiest clients hitting a web server

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -20

In common and combined log formats, the first field is the client IP. If your server sits behind a load balancer or CDN, you will see the proxy's address instead, so check the forwarded-for header in your log format first. A variation on the same idea is ranking HTTP status codes to spot spikes in 401, 403, or 404 responses:

awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

Compare your logs against a threat-intel list

comm -12 <(sort bad_ips.txt) <(sort seen_ips.txt)

The comm utility needs sorted input. This prints only the lines that appear in both files, meaning IPs from your watchlist that also showed up in your logs. This syntax uses bash process substitution, so it will not work in plain sh.

Merge logs from multiple hosts by time

cat host1.log host2.log | sort -k1,1M -k2,2n -k3,3

For traditional syslog-style timestamps such as "Sep 19 02:47:13," this sorts by month name (M), then day (numeric), then time. It is a rough way to build a combined timeline before you have data in a SIEM.

Detection and Prevention Takeaways

Sorting and counting is a triage technique, not a full detection system. It tells you what stands out. It does not tell you whether something is malicious. A few practical points from day-to-day SOC work:

• Look for the shape, not just the top number. One IP with thousands of failures suggests a noisy, single-source attempt. Many IPs with a few failures each may suggest distributed guessing. Both are worth escalating, and they call for different responses.
• Correlate failures with successes. A burst of failed logins followed by an accepted login from the same source is the pattern that matters most. Check Accepted entries for any IP high on your failure list.
• Harden the entry point. Prefer key-based SSH authentication, disable direct root login, require MFA where possible, and use rate limiting or automated blocking tools. No single control is foolproof, so layer them.
• Centralize logs. Shell one-liners do not scale across a fleet. Forward logs to a SIEM or log management platform so retention, alerting, and correlation do not depend on someone running commands at 3 AM.
• Preserve evidence. Work on copies of logs during an investigation, and use sort -o or redirect to new files rather than modifying originals.

Expert Tips for Faster, Safer Sorting

• Set the locale for predictable results. Sorting behavior depends on locale. Running LC_ALL=C sort file.txt forces plain byte-order comparison, which is faster and gives identical output across machines. It is a good habit in scripts.
• Use -b for messy whitespace. sort -b ignores leading blanks, which helps when columns are padded with spaces.
• Verify order with -c. sort -c file.txt checks whether a file is already sorted and reports the first out-of-order line. It is useful before running comm.
• Use -s for stable sorting. Stable sort preserves the original relative order of lines with equal keys, which matters when sorting by one column of chronological logs.
• Tune for big files. GNU sort supports -S for the memory buffer, -T for the temp directory, and --parallel for multiple threads, for example sort -S 2G --parallel=4 big.log. Make sure the temp directory has enough free space, since large sorts spill to disk.
• Handle odd filenames with -z. Use NUL-terminated records when sorting file paths that might contain newlines.
• Prefer -k1,1 over -k1. Always specify where the key ends unless you truly want it to run to the end of the line.

Quick Reference Table

Goal	Command
Alphabetical / reverse	sort file.txt / sort -r file.txt
Numeric / highest first	sort -n / sort -nr
Unique lines	sort -u file.txt
Case-insensitive	sort -f file.txt
Human-readable sizes	sort -h sizes.txt
Version-style / IP order	sort -V ip.txt
Column 2 numeric	sort -k2,2n data.txt
CSV column 3 numeric	sort -t',' -k3,3n data.csv
Top processes by CPU	ps aux | sort -k3,3nr
Frequency count	sort | uniq -c | sort -nr
Sort in place safely	sort -o file.txt file.txt

Related Cybersecurity Topics You Should Explore

• Settra Ransomware: The Log Attackers Forgot to Clear
  
• UAE's AI Lab Tests Every Model for Hidden Risks
  
• Check Point CVE-2026-91843: Root Access, No Login Needed (Patch Now)
  
• Why 40% of Indian SMEs Got Breached Despite Rising Cybersecurity Budgets
  
• cPanel's EmailTrack Bug: How Low-Privilege Users Reach Root Access
  
• 3,562 Redis Servers Hacked for Crypto Mining: Is Your Server Next?
  
• CVE-2026-26084 Explained: Patch FortiSandbox Now
• Fortinet Patches Silent MITM Flaw in FortiOS and FortiProxy ZTNA
  
• Linux cut Command Explained: Extract Any Field, Column, or Character in Seconds

FAQ

What does the sort command do by default?

It sorts lines of text in ascending order, comparing each whole line using your system locale's rules. It does not change the original file unless you use -o to write back to it.

What is the difference between sort -u and sort | uniq?

For whole lines, they produce the same result. The difference appears with -k: sort -u -k2,2 removes lines whose second field matches, while uniq compares entire lines.

Why is my numeric sort giving wrong results?

Usually the -n flag is missing, or the values include thousands separators or size suffixes. Use -n for plain numbers, -h for values like 10K or 2M, and -g for scientific notation.

How do I sort a CSV file by a specific column?

Set the delimiter with -t',' and choose the column with -k, for example sort -t',' -k3,3n data.csv. This fails on fields containing quoted commas, so use a dedicated CSV tool for complex files.

How do I sort IP addresses correctly?

Use sort -V on GNU systems, or sort each octet numerically with sort -t. -k1,1n -k2,2n -k3,3n -k4,4n. Plain alphabetical sorting places 10.0.0.10 before 10.0.0.2.

Is sort case-sensitive?

It depends on your locale. Some locales interleave upper- and lowercase letters, while LC_ALL=C sorts uppercase before lowercase. Use -f to ignore case explicitly.

Can sort handle very large log files?

Yes. GNU sort uses temporary files for data that does not fit in memory. You can raise the buffer with -S, point -T at a fast disk with free space, and use --parallel to speed things up.

Conclusion

The sort command looks simple, but it is one of the most useful tools in a defender's kit. Learn the core flags (-n, -r, -u, -h, -k, -t, -V), remember the sort | uniq -c | sort -nr pattern, and avoid the two classic traps: open-ended -k keys and redirecting output onto the input file. With those habits, a 40,000-line log stops being an obstacle and becomes a ranked list you can act on. Then hand the heavy lifting to your SIEM for continuous monitoring.

Analysis based on SOC monitoring experience and review of public command documentation.