Hosting Operations
Read-only, can be slowCount Request IDs in Error Lines
An app log includes request IDs, and you need to see which failing request appears more than once.
Command
grep -Ei 'error|timeout|fatal|exception' /var/log/app/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nrBefore you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not use it when logs lack stable IDs; group by source, path, user, or job name instead.
Expected output
Counts followed by request_id values.
System impact
Read-only, can be slow. Nothing changes. The command extracts request IDs from severe lines and counts repeats.
May require elevated permissions on protected paths or service-owned files.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use when multiple log lines may belong to the same failed request or job.
When not to use it
Do not use it when logs lack stable IDs; group by source, path, user, or job name instead.
next steps
Related commands
Count App Errors by Minute
A minute-by-minute count shows whether an incident is a spike or a drip.
awk 'tolower($0) ~ /(error|fatal|timeout|exception)/ {minute=substr($1,1,16); count[minute]++} END {for (m in count) print count[m], m}' /var/log/app/app.log | sort -nr
Show Context Around the First App Error
The first error often explains more than the last one.
awk '{buf[NR%5]=$0} tolower($0) ~ /(error|exception|fatal)/ {for (i=NR-4;i<=NR;i++) if (i>0) print buf[i%5]; exit}' /var/log/app/app.log
Group Server Errors by URL Path
A 500 spike is easier to triage when the broken path is obvious.
awk '$9 ~ /^5/ {count[$7]++} END {for (path in count) print count[path], path}' /var/log/nginx/access.log | sort -nr | head
Find Unusually Large Web Responses
A few huge responses can explain bandwidth, latency, and suspicious download patterns.
awk '$10 ~ /^[0-9]+$/ && $10 > 1000000 {print $10, $1, $7, $9}' /var/log/nginx/access.log | sort -nr | head
Find Top 404 URLs
The missing file was not random. The access log had a pattern.
awk '$9==404 {print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.