How To Use Grep + Regex To Match Non-200 HTTP Status Codes In Apache Server Logs
When parsing Apache web server logs on Linux, I find it interesting to monitor access requests resulting in HTTP status codes other than 200s. An HTTP status code in the 200s mean the request was successful, and hey–that’s boring.
I want to see the requests that my dear Apache instance is upset about. So the question becomes…how do I filter the logs to show me every entry that doesn’t have a status code in the 200s?
Let’s back our way into this. We’ll start with the answer, then explain how we got there.
The Answer
This CLI incantation will get the job done.
sudo grep -E '\" [1345][01235][0-9] [[:digit:]]{1,8} \"' /var/log/apache2/access.logIf you’d like to watch the log entries scroll by in real time, try this.
sudo tail -f /var/log/apache2/access.log | grep -E '\" [1345][01235][0-9] [[:digit:]]{1,8} \"'Comprehending The Regex
Let’s focus on the regular expression (regex) grep is using to find the matches. In plain English, the grep utility is using an extended -E regex to display all lines in the file /var/log/apache2/access.log matching the regex.
The regex portion of the command is as follows.
'\" [1345][01235][0-9] [[:digit:]]{1,8} \"'
The regex is enclosed in single quotes Continue reading
Virtual only has value.
