Regular expression for monitoring HTTP errors in apache logs

apache-2.2regular expressions

I'm looking for a regular expression that I can use to scan for HTTP errors in my standard apache log files.

I'm interesting in matching all lines that don't have an HTTP 200 or HTTP 204 return status.

I can match the lines that do contain either HTTP 204 or HTTP 200 return code

grep 'HTTP[^"]*" 204 \| HTTP[^"]*" 200'

But I would like to have the inverse. I'm also sure the expression above can be optimized.

I need to feed such regular expression to an external program, so using grep -v to inverse it is not an option.

Best Answer

Ordinary regular expressions don't include a way to negate anything except a single character, so I think you'll have to provide the whole list of codes you do want:

HTTP[^"]*" (1|20[12356]|3|4|5)

Perl-compatible REs do allow you to negate strings of text, so if you were using those you could use

HTTP[^"]*" (?!(200|204))

Related Solutions

How to return 404 from Apache2 CGI program

Use the Status HTTP header. An example in Perl:

#!/usr/bin/perl

use strict;
use warnings;

print "Status: 404 Not Found\r\n";
print "Content-Type: text/html\r\n\r\n";

print "<h1>404 File not found!</h1>";

When using Perl (and other languages) however, excellent modules like CGI and CGI::Simple exist.

Firewall – Watchguard Firewall WebBlocker Regular Expression for Multiple Domains

I do this exact same thing on my Watchguard.

Here is the regex I use, edited to fit the domains you're working with.

(?i)^([^./]+\.)*(grooveshark\.com|gs-cdn\.net)(?![^/])

I'm not sure if you intended to leave the k off grooveshark at one point in your question or if it was just a typo. If they were to use grooveshar.com sometimes then you would need this:

(?i)^([^./]+\.)*(grooveshark?\.com|gs-cdn\.net)(?![^/])

The ? after the k just makes it not necessary.

I highly recommend The Regex Coach to help you build regex.

I also highly recommend http://www.regular-expressions.info/ as a reference.

Best Answer

Related Solutions

How to return 404 from Apache2 CGI program

Firewall – Watchguard Firewall WebBlocker Regular Expression for Multiple Domains

Related Topic