Playbook: mine status codes from raw access logs

Playbook: mine status codes from raw access logs
The grep/awk recipes worth keeping in a snippets file, credited to their authors.
→ Julia Evans' (b0rk) log one-liners — awk '{print $9}' access.log | sort | uniq -c | sort -rn for a full status histogram. Takeaway: field 9 is the status in Combined format.
→ Server Fault canonical answer on isolating 5xx spikes by hour with awk date slicing. Takeaway: bucket by the bracketed timestamp to catch incident windows.
★ Pick of the week — Elijah Manor's grep-for-Googlebot-errors snippet — filters to bot UA then to 4xx/5xx in one pipe. Takeaway: grep Googlebot | awk '$9 ~ /^[45]/' surfaces what Google actually sees broken.
→ GoAccess docs — when grep gets tedious, it renders the same counts live. Takeaway: good for a second pair of eyes on the numbers.
Always confirm your field positions before trusting any one-liner.