Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a command to list the 10 or 20 top 404 error URLs out of my apache access_log. Can anyone help me with this?

thanks

share|improve this question
add comment

2 Answers

Assuming the normal access_log format this should do it:

cat access_log | awk '{ if($9 == 404) { print $7 } }' | sort | uniq -c | sort -r | head -10
share|improve this answer
    
I hadn't thought of the field math, good call. I edited to fix the error code. –  Scott Pack Feb 3 '11 at 16:16
    
@packs That was fast, I just noticed the issue when I double checked it again and you got to it before I could. :) –  carson Feb 3 '11 at 16:19
    
Ninja edit! –  Scott Pack Feb 3 '11 at 16:23
    
Brilliant, thanks a lot! :) –  tykho Feb 5 '11 at 14:30
1  
sort -r sorts alphabetically in reverse, so it will put "1", "10" and "100" after "2". You should use numeric reverse sort: sort -nr. –  Christian Davén Oct 30 '12 at 9:26
show 2 more comments

I've done this using standard unix utilities, awk, sort, etc, and it works fairly well. Since the format of your logs could be different, you may have to change some things to work in your environment, but the basic command would be this:

cat access_log | awk '/" 404 / {print $7}' | sort | uniq -c | sort -n | tail -n10

If you are not familiar with awk, what we are doing is:

for each line
   if it contains the string '" 404', then
     print the 7th field (where fields are space delimited) 

If you are using a custom apache log format, then you will need to change the $7 to match the field for the URL in the GET request. You can also change the number of lines from the tail command to display more, or rewer, results.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.