Add a juju action to report on top visits by IP

[Tom Haddon]

During a potential DoS attack it's useful to quickly retrieve a list of most visits by IP. During a recent issue, an SRE ran the following:

juju run --application content-cache-1ss,content-cache-gs2 -- "awk '/Feb 24 11:/{print \$6}' /var/log/haproxy.log | cut -d ':' -f 1 | sort | uniq -c | sort -rn | head " | pp

This should really be a juju action so it's very obvious and easy for anyone to do this.

[Haw Loeung (hloeung)]

This command would be better as it supports IPv6 as well as includes the sites or listen stanzas being hit:

| awk '/Feb 25 06:/ && $6 !~ /127.0.0.1/ {print $6 " " $8 }' /var/log/haproxy.log | sed -e 's/:[0-9]* / /' | sort | uniq -c | sort -k1 -n -r | head

We also want to replace the date/time "Feb 25 06:" with the last 20 mins or so.