Count App Errors by Minute

You need to see when severe application log lines clustered during an incident.

Command

awk 'tolower($0) ~ /(error|fatal|timeout|exception)/ {minute=substr($1,1,16); count[minute]++} END {for (m in count) print count[m], m}' /var/log/app/app.log | sort -nr

Before you run this

System impact: Read-only. Low when scoped to the shown target.

When not to use it: Do not use it as a metrics replacement; it is a quick log-derived approximation.

Expected output

Counts followed by minute timestamps.

System impact

Read-only. Nothing changes. The command counts severe application lines by minute.

May require elevated permissions on protected paths or service-owned files.

Recovery / rollback: no state is changed.

When to use it

Use when you need to compare an error spike with deploys, restarts, or external alerts.

When not to use it

Do not use it as a metrics replacement; it is a quick log-derived approximation.

next steps

Related commands

Hosting Operations Can be slow

Count Request IDs in Error Lines

Repeated request IDs can connect separate error lines to one failing path.

grep -Ei 'error|timeout|fatal|exception' /var/log/app/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nr

Hosting Operations Read-only

Group Server Errors by URL Path

A 500 spike is easier to triage when the broken path is obvious.

awk '$9 ~ /^5/ {count[$7]++} END {for (path in count) print count[path], path}' /var/log/nginx/access.log | sort -nr | head

Hosting Operations Read-only

Summarize HTTP Status Codes

Before chasing individual lines, get the shape of the whole log.

awk '{count[$9]++} END {for (code in count) print count[code], code}' /var/log/nginx/access.log | sort -nr

Cybersecurity Triage Read-only

Spot Request Bursts by Minute

Traffic spikes are easier to read when you bucket them by time.

awk '{minute=substr($4,2,17); count[minute]++} END {for (m in count) print count[m], m}' /var/log/nginx/access.log | sort -nr | head

Hosting Operations Can be slow

Summarize Journal Severity During an Incident

Start with severity counts before opening every log line.

journalctl -p warning..alert --since "2 hours ago" --no-pager -o short-iso | awk '{count[$4]++} END {for (level in count) print count[level], level}' | sort -nr

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.