Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an apache log file. I need to report how many rows (request) are from a specific context root. The apache logs already start with a slash and context root is to the second slash.

Example Apache Log: - - [14/Feb/2013:00:27:33 -0600] "GET /lifecontent/monitor?test=siteseer&format=siteseer HTTP/1.1" 200 275 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" "SSL=on"
111.22.333.44 - - [14/Feb/2013:00:29:29 -0600] "GET /lc/Brokerage%20Manager/IDG%20Licensing%20and%20Appointment%20Process/IDG%20Franchise%20Reference%20Manual HTTP/1.1" 302 - "-" "(Windows NT)" "SSL=-"

The two context roots would be "/lifecontent/" and "/lc"

Not sure what tool would be best? I am comfortable with GUI or batch solution.

I mostly am just trying to figure out what percentage each context root is being used within an apache files. (Ideally it could search through multiple files at once, but not a requirement.)

share|improve this question
any kind of log analyzer that can parse apache log files would suffice. You might have to prep your logs with sed if the analyzer you turn up doesn't aggregate results according to your needs. – fuero Feb 14 '13 at 22:06
up vote 1 down vote accepted

You can do this with a simple shell script:

cut -d/ -f4 access.log | sort | uniq -c | sort -g

The cut command extracts the 5th /-delimited field (i.e. the "context root"), sort | uniq -c then counts the number of occurrences of each, and sort -g orders them by number of occurrences.

Running this on my webserver gives:

   5477 misc
  11130 bzr
  32181 raspbian
  35912 files
  43020 sites
share|improve this answer

I accepted mgorven solution because it sent me in the right direction for a final working solution. Afetr using his solution, sometimes there are query string values and sometimes the context root does not have have an ending slash. So "/lc/" and "/lc" and "/lc?x=y" get counted as "lc". So I ending up using this solution:

cut -d" " -f7 access.log | cut -d? -f1 | cut -d/ -f2 | sort | uniq -c | sort -g

This will show individual files that got accessed and an empty line if just "/" was accessed.

Also I did this on windows using All I needed to extract was cut, sort, uniq.

Thank you mgorven!!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.