Analyze apache logs with awk

Archive note: This article reflects the tools and environment in use when it was published in 2019.

awk is a great tool for quick, hands-on command-line analysis of Apache requests. The exact syntax depends on the LogFormat, of course, which I cannot disclose here for compliance reasons.

Today I was looking for requests that took longer than three seconds; request time is reported in microseconds in my log. I also needed the URL and wanted to limit the results to a specific time range. In this example, 2019:04:1 represents all requests today between 04:10 and 04:19 UTC.

Here’s my command:

cat /httpd/logs/access.log |grep "2019:04:1"| awk '{if ($(NF-2) > 3000000) print $4"-----"$7"-----"$(NF-2);}'

$(NF-2) is the third-to-last field in each row, and I know that this field contains the request time in microseconds. The command prints the timestamp (the fourth field, $4), the URL ($7), and the request time ($(NF-2)).