Hosting Operations

Group Server Errors by URL Path

You need to see which URL paths are associated with server-side errors in an access log.

Command

awk '$9 ~ /^5/ {count[$7]++} END {for (path in count) print count[path], path}' ./fixtures/nginx/access.log | sort -nr | head

What changed

Nothing changes. The command groups 5xx responses by request path.

Danger

safe

When to use it

Use this when deciding whether a server-error spike is site-wide or concentrated on one route.

When not to use it

Do not assume the path is the root cause; upstream app logs are still needed.

Undo or recovery

No undo needed because the command is read-only.

Expected output

A descending list of 5xx counts followed by URL paths.

demo script

Disposable terminal steps

awk '$9 ~ /^5/ {print $1, $7, $9}' ./fixtures/nginx/access.log
awk '$9 ~ /^5/ {count[$7]++} END {for (path in count) print count[path], path}' ./fixtures/nginx/access.log | sort -nr | head
awk '{count[$9]++} END {for (code in count) print count[code], code}' ./fixtures/nginx/access.log | sort -nr

Terminal transcript Demo JSON

simulated output

What it looks like

disposable vessel

::fixture-ready::
$ awk '$9 ~ /^5/ {print $1, $7, $9}' ./fixtures/nginx/access.log
198.51.100.21 /api/report 500
198.51.100.22 /api/report 502
198.51.100.23 /api/report 503
::exit-code::0
$ awk '$9 ~ /^5/ {count[$7]++} END {for (path in count) print count[path], path}' ./fixtures/nginx/access.log | sort -nr | head
3 /api/report
::exit-code::0
$ awk '{count[$9]++} END {for (code in count) print count[code], code}' ./fixtures/nginx/access.log | sort -nr
13 200
5 404
2 405
2 403
1 503
1 502
1 500
::exit-code::0

YouTube Short

Find which route is throwing 5xx.

A server error spike is vague until you group it by path. This one-liner shows whether one route is failing or the whole site is in trouble.

experiments

A/B tests to run

Metric: youtube_retention_15s

A: A 500 spike usually has a path.

B: Find the broken route before blaming the server.