<b>awk one-liners for status-code mining</b>

<b>awk one-liners for status-code mining</b>

Four hand-picked snippets that turn a raw access log into a status report in seconds. Credit to the authors who shared them.

→ Julia Evans' 'awk for log files' explainers — the gentlest intro to <code>$9</code> being the status field in Combined format.
Takeaway: learn field positions once, reuse forever.

⭐ Pick of the week: the count-by-status idiom from nixCraft —
<code>awk '{print $9}' access.log | sort | uniq -c | sort -rn</code>
Instant histogram of 200 vs 301 vs 404 vs 5xx.
Takeaway: this is your first command on any new log.

→ The Grymoire awk tutorial (Bruce Barnett) — for when you need conditional sums, e.g. bytes served only on 200s.

→ Brendan Gregg's notes on awk associative arrays — group 404s by URL without loading anything into a database.

Every one of these runs on a stock server, no installs.