inetquestion wrote:
> I am looking for a way to monitor the count of each HTTP response
> codes from apache reverse proxy servers.

if you have a high volume of traffic or serve content from multiple machines,
the log-grepping approach is a pain.

for a quick summary of any http response codes in your live apache logs you can
run this (its one unix command line and assumes combined log format):

cat logfile1 logfile2 logfileN | perl -ane 'print qq#$3-$2-$1 $4\t$5\n# if
m#\[\s*?(\d+)/(.*?)/(\d+):(\d+):.*? HTTP/.*?"\s+(\d+)#;' | sort | uniq -c

to produce output like this:

HITS DATE HOUR CODE
291 2008-May-05 10 200
1 2008-May-05 10 301
6 2008-May-05 10 302
1 2008-May-05 10 401
13 2008-May-05 13 200
1 2008-May-05 13 301
1 2008-May-05 13 404
4 2008-May-05 14 200

if you really want to run this every 10 minutes on live logs, you won't need the
year, month, date, just each 10-minute period you're summarizing:

cat logfile1 logfile2 logfileN | perl -ane 'print qq#$1:${2}0\t$3\n# if
m#\[\s*?\d+/.*?/\d+:(\d+):(\d).*? HTTP/.*?"\s+(\d+)#;' | sort | uniq -c

resulting in:

HITS TIME CODE
21 09:20 200
2 09:20 302
31 09:30 200
3 09:30 302
20 10:00 200
1 10:00 301
1 10:00 401
240 10:10 200
3 10:10 302
31 10:20 200
3 10:20 302
7 12:00 200
6 12:10 200

> Ultimately I would like the ability to poll the the count of each HTTP
> response code without having to parse access logs period. I checked

for a longer-term solution, any of the log-based web analytics tools will
summarize http response codes for you, here are a few of them:

http://webalizer.org/ (hits by response code)
http://analog.cx/ (status code report)
http://awstats.sourceforge.net/ (http status codes)

analog in particular is fast and configurable, you can probably automate it to
run only the status code report as frequently as you need, and generate
machine-readable output that you might use in a monitoring system like nagios.

--sean

--
sean dreilinger - http://durak.org/sean/