Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to get the memory usage from the following log entries. It's the number right after 200 for the URL. I'd like to get a list of highest memory usage first, like top 10. I think I'd use grep for this, right?

178.0.140.206 - - [05/Nov/2010:16:46:09 -0400] "GET /image/promo/terran-88x31.jpg HTTP/1.1" 200 15227 0 -
79.66.101.95 - - [05/Nov/2010:16:46:09 -0400] "GET /strategy/article/view/?id=608 HTTP/1.1" 200 8456 0 4980736
79.66.101.95 - - [05/Nov/2010:16:46:10 -0400] "GET /lib/php/min/?f=lib/css/yui/2.7.0.css,lib/css/base.css,lib/css/ux/rating.css,lib/css/page/strategy.css,lib/css/page/article.css,lib/css/page/strategy/article.css HTTP/1.1" 200 8118 0 1835008
79.66.101.95 - - [05/Nov/2010:16:46:11 -0400] "GET /image/logo-text.png HTTP/1.1" 200 9444 0 -
79.66.101.95 - - [05/Nov/2010:16:46:11 -0400] "GET /image/s.gif HTTP/1.1" 200 43 0 -
79.66.101.95 - - [05/Nov/2010:16:46:11 -0400] "GET /image/logo.png HTTP/1.1" 200 17722 0 -
79.66.101.95 - - [05/Nov/2010:16:46:13 -0400] "GET /lib/php/min/?f=lib/js/ext/3.0-core.js,lib/js/global.js,lib/js/ext/ux/rating.js,lib/js/page/article.js HTTP/1.1" 200 32919 0 1310720
79.66.101.95 - - [05/Nov/2010:16:46:16 -0400] "GET /lib/css/resource/body-bg.png HTTP/1.1" 200 467 0 -
79.66.101.95 - - [05/Nov/2010:16:46:16 -0400] "GET /lib/css/resource/foot-bg.png HTTP/1.1" 200 119 0 -
79.66.101.95 - - [05/Nov/2010:16:46:16 -0400] "GET /lib/css/resource/search-bg-sprite.png HTTP/1.1" 200 280 0 -
190.213.177.71 - - [05/Nov/2010:16:46:16 -0400] "GET /images/banner/dark-templar_firefox.gif HTTP/1.1" 404 2827 0 1572864
share|improve this question
    
grep | awk/sed | sort –  Andrejs Cainikovs Nov 7 '10 at 15:25
add comment

2 Answers

up vote 2 down vote accepted

Assuming you want the URL being access as well (you can tweak the awk print statement as needed to get more fields):

awk '{ print $10,$7 }' PATH_TO_LOG_FILE | sort -k1 -rn | head -n10

To use it for only a specific HTTP code (in this case, 200):

awk '{ if($9=="200") {print $10,$7} }' PATH_TO_LOG_FILE | sort -k1 -rn | head -n10

Or use a regex to check for multiple error codes:

awk '{ if($9~"^200|403|404$") {print $10,$7} }' PATH_TO_LOG_FILE | sort -k1 -rn | head -n10

If this is something you plan on running repeatedly, consider looking into a CustomLog.

share|improve this answer
    
Your regex should be "^(200|403|404)$". The default for sort is -k1 so you could omit that unless you meant to do -k1,1. –  Dennis Williamson Nov 7 '10 at 16:13
    
Because we're not matching the HTTP return code for use, there's no need to group it. As for the sort, you're absolutely right--although in this case, I prefer to be explicit. –  Andrew M. Nov 7 '10 at 16:19
add comment

I know that these numbers reflect the returned content size. Anyway, you can get the needed column (after 200) using this commnad:

grep "1.1\" 200 " logfile | awk {'print $10'} | sort -nr | head -n 10
share|improve this answer
    
You should do sort -nr for a numeric sort and some versions of head require -n: head -n 10 –  Dennis Williamson Nov 7 '10 at 16:10
    
It should be ok now! –  Khaled Nov 7 '10 at 16:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.