apahce log format (ltsv)

httpd.conf

# http://y-ken.hatenablog.com/entry/apache-tips-ltsv-access-log

LogFormat "host:%h\tident:%l\tuser:%u\ttime:%{%Y-%m-%dT%H:%M:%S%z}t\tmethod:%m\turi:%U%q\tprotocol:%H\tstatus:%>s\tsize:%b\tresponse_time:%D\trefer:\"%{Referer}i\"\tuser_agent:\"%{User-Agent}i\"" ltsv

log

host:127.0.0.1       ident:- user:-  time:2013-11-05T20:14:54+0900   method:GET      uri:/index.html protocol:HTTP/1.1       status:200      size:9     response_time:326 refer:"-"       user_agent:"curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2"

request_count

# request count
cat /path/to/access.log | awk '{ print $6 }' | sed 's/response_time://g' | sed 's/uri://g' | sed 's/time://g' | sed 's/?.*//g' | sort -n | uniq -c

# 時間を範囲指定して request count
START_TIME=`date -d "2013-11-05 20:04:09" "+%Y%m%d%H%M%S"`; END_TIME=`date -d "2013-11-05 20:04:09" "+%Y%m%d%H%M%S"` ; cat /path/to/access.log | awk '{ print $4, $6 }' | sed 's/response_time://g' | sed 's/uri://g' | sed 's/time://g' | sed 's/?.*//g' | awk '{time=$1; gsub(/[:T+\-]|0900/, "", time);} '"$START_TIME"' <= time && time <= '"$END_TIME"' { print $2 }' | sort -n | uniq -c

response_time_sort

# response time 降順
cat /path/to/access.log | awk '{ print $4, $10, $6 }' | sed 's/response_time://g' | sed 's/uri://g' | sed 's/time://g' | sed 's/?.*//g' | awk '$2 >= 100 { printf "%s \t %.6f sec \t %.3f msec \t %s\n", $1, $2 / 1000000, $2 / 1000, $3 }' | sort -nr -k 2

# 時間を範囲指定して response time 降順 sort
START_TIME=`date -d "2013-11-05 20:04:09" "+%Y%m%d%H%M%S"`; END_TIME=`date -d "2013-11-05 20:04:09" "+%Y%m%d%H%M%S"` ; cat /path/to/access.log | awk '{ print $4, $10, $6 }' | sed 's/response_time://g' | sed 's/uri://g' | sed 's/time://g' | sed 's/?.*//g' | awk '{time=$1; gsub(/[:T+\-]|0900/, "", time);} '"$START_TIME"' <= time && time <= '"$END_TIME"' { printf "%s \t %.6f sec \t %.3f msec \t %s\n", $1, $2 / 1000000, $2 / 1000, $3 }' | sort -nr -k 2