1

I'd like to get the memory usage from the following log entries. It's the number right after 200 for the URL. I'd like to get a list of highest memory usage first, like top 10. I think I'd use grep for this, right?

178.0.140.206 - - [05/Nov/2010:16:46:09 -0400] "GET /image/promo/terran-88x31.jpg HTTP/1.1" 200 15227 0 -
79.66.101.95 - - [05/Nov/2010:16:46:09 -0400] "GET /strategy/article/view/?id=608 HTTP/1.1" 200 8456 0 4980736
79.66.101.95 - - [05/Nov/2010:16:46:10 -0400] "GET /lib/php/min/?f=lib/css/yui/2.7.0.css,lib/css/base.css,lib/css/ux/rating.css,lib/css/page/strategy.css,lib/css/page/article.css,lib/css/page/strategy/article.css HTTP/1.1" 200 8118 0 1835008
79.66.101.95 - - [05/Nov/2010:16:46:11 -0400] "GET /image/logo-text.png HTTP/1.1" 200 9444 0 -
79.66.101.95 - - [05/Nov/2010:16:46:11 -0400] "GET /image/s.gif HTTP/1.1" 200 43 0 -
79.66.101.95 - - [05/Nov/2010:16:46:11 -0400] "GET /image/logo.png HTTP/1.1" 200 17722 0 -
79.66.101.95 - - [05/Nov/2010:16:46:13 -0400] "GET /lib/php/min/?f=lib/js/ext/3.0-core.js,lib/js/global.js,lib/js/ext/ux/rating.js,lib/js/page/article.js HTTP/1.1" 200 32919 0 1310720
79.66.101.95 - - [05/Nov/2010:16:46:16 -0400] "GET /lib/css/resource/body-bg.png HTTP/1.1" 200 467 0 -
79.66.101.95 - - [05/Nov/2010:16:46:16 -0400] "GET /lib/css/resource/foot-bg.png HTTP/1.1" 200 119 0 -
79.66.101.95 - - [05/Nov/2010:16:46:16 -0400] "GET /lib/css/resource/search-bg-sprite.png HTTP/1.1" 200 280 0 -
190.213.177.71 - - [05/Nov/2010:16:46:16 -0400] "GET /images/banner/dark-templar_firefox.gif HTTP/1.1" 404 2827 0 1572864
1

2 Answers 2

3

Assuming you want the URL being access as well (you can tweak the awk print statement as needed to get more fields):

awk '{ print $10,$7 }' PATH_TO_LOG_FILE | sort -k1 -rn | head -n10

To use it for only a specific HTTP code (in this case, 200):

awk '{ if($9=="200") {print $10,$7} }' PATH_TO_LOG_FILE | sort -k1 -rn | head -n10

Or use a regex to check for multiple error codes:

awk '{ if($9~"^200|403|404$") {print $10,$7} }' PATH_TO_LOG_FILE | sort -k1 -rn | head -n10

If this is something you plan on running repeatedly, consider looking into a CustomLog.

2
  • Your regex should be "^(200|403|404)$". The default for sort is -k1 so you could omit that unless you meant to do -k1,1. Nov 7, 2010 at 16:13
  • Because we're not matching the HTTP return code for use, there's no need to group it. As for the sort, you're absolutely right--although in this case, I prefer to be explicit.
    – Andrew M.
    Nov 7, 2010 at 16:19
1

I know that these numbers reflect the returned content size. Anyway, you can get the needed column (after 200) using this commnad:

grep "1.1\" 200 " logfile | awk {'print $10'} | sort -nr | head -n 10
2
  • You should do sort -nr for a numeric sort and some versions of head require -n: head -n 10 Nov 7, 2010 at 16:10
  • It should be ok now!
    – Khaled
    Nov 7, 2010 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .