🎓 A1Learner
🔍
0 of 46 lessons completed

Bash Project: Log Analyzer

A log analyzer is a script that reads a log file and sums up what it holds. It counts lines per level and shows which messages appear most often.

Count lines per level with grep -c

The log file is created first, then grep -c counts each level. Command substitution puts each count after its level label.

printf 'INFO server started\nINFO user login\nINFO backup done\nWARN disk low\nWARN retry slow\nERROR disk full\nERROR disk full\nERROR connection lost\n' > app.log
echo "INFO: $(grep -c '^INFO' app.log)"
echo "WARN: $(grep -c '^WARN' app.log)"
echo "ERROR: $(grep -c '^ERROR' app.log)"

Count levels with one awk pass

Awk counts every level in one read of the file. Piping the result through sort puts the levels in a fixed order.

printf 'INFO server started\nINFO user login\nINFO backup done\nWARN disk low\nWARN retry slow\nERROR disk full\nERROR disk full\nERROR connection lost\n' > app.log
awk '{count[$1]++} END {for (level in count) print level, count[level]}' app.log | sort

Rank the error messages

Grep keeps only the error lines, and cut drops the ERROR word. Sorting, counting, and reverse numeric sorting rank the messages by count.

printf 'INFO server started\nINFO user login\nINFO backup done\nWARN disk low\nWARN retry slow\nERROR disk full\nERROR disk full\nERROR connection lost\n' > app.log
grep '^ERROR' app.log | cut -d' ' -f2- | sort | uniq -c | sort -nr

Example

printf 'INFO server started\nINFO user login\nINFO backup done\nWARN disk low\nWARN retry slow\nERROR disk full\nERROR disk full\nERROR connection lost\n' > app.log
echo "Log summary"
echo "Level counts:"
awk '{count[$1]++} END {for (level in count) print level, count[level]}' app.log | sort
echo "Top error messages:"
grep '^ERROR' app.log | cut -d' ' -f2- | sort | uniq -c | sort -nr

Key points

  • grep -c: count the lines that match a pattern, instead of printing them.
  • awk counting: keep one counter per level in an associative array.
  • Sorted keys: print associative-array results through sort for a fixed order.
  • cut -d' ' -f2-: drop the level word so only the message text remains.
  • sort | uniq -c | sort -nr: rank messages from most common to least.

In this example, the log file is created first with three info lines, two warnings, and three errors. The awk pass counts lines per level, and sort puts those counts in level order. Then grep keeps only the error lines, cut drops the level word, and the sort, uniq -c, and sort -nr chain ranks the messages by count.

Try it Yourself

Edit the code, then press Run.

Running is simulated

Exercise

Why does the analyzer pipe awk output through sort?