Hosting Operations
Read-onlySummarize HTTP Status Codes
A web incident has too many log lines to read one by one, and you need the response-code shape before choosing the next drill-down.
Command
awk '{count[$9]++} END {for (code in count) print count[code], code}' /var/log/nginx/access.log | sort -nrBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not stop at the summary. Follow suspicious code families by IP, path, and time window before changing config or blocking clients.
Expected output
Counts followed by HTTP status codes, usually enough to show whether 4xx, 5xx, redirects, or 2xx responses dominate.
System impact
Read-only. Nothing changes. The command reads the log and counts response codes; real logs can contain IPs, paths, and user data, so handle output as operational evidence.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use this as the first pass when deciding whether the incident is mostly redirects, client errors, server errors, or normal traffic with a few noisy lines.
When not to use it
Do not stop at the summary. Follow suspicious code families by IP, path, and time window before changing config or blocking clients.
next steps
Related commands
Group Server Errors by URL Path
A 500 spike is easier to triage when the broken path is obvious.
awk '$9 ~ /^5/ {count[$7]++} END {for (path in count) print count[path], path}' /var/log/nginx/access.log | sort -nr | head
Find Unusually Large Web Responses
A few huge responses can explain bandwidth, latency, and suspicious download patterns.
awk '$10 ~ /^[0-9]+$/ && $10 > 1000000 {print $10, $1, $7, $9}' /var/log/nginx/access.log | sort -nr | head
Count App Errors by Minute
A minute-by-minute count shows whether an incident is a spike or a drip.
awk 'tolower($0) ~ /(error|fatal|timeout|exception)/ {minute=substr($1,1,16); count[minute]++} END {for (m in count) print count[m], m}' /var/log/app/app.log | sort -nr
Find Top 404 URLs
The missing file was not random. The access log had a pattern.
awk '$9==404 {print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
Find the IPs Creating the Most 4xx Noise
One address can turn a normal access log into a wall of failed requests.
awk '$9 ~ /^4/ {count[$1]++} END {for (ip in count) print count[ip], ip}' /var/log/nginx/access.log | sort -nr | head
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.