Regular expression for monitoring HTTP errors in apache logs

Question

I'm looking for a regular expression that I can use to scan for HTTP errors in my standard apache log files.

I'm interesting in matching all lines that don't have an HTTP 200 or HTTP 204 return status.

I can match the lines that do contain either HTTP 204 or HTTP 200 return code

grep 'HTTP[^"]*" 204 \| HTTP[^"]*" 200'

But I would like to have the inverse. I'm also sure the expression above can be optimized.

I need to feed such regular expression to an external program, so using grep -v to inverse it is not an option.

score 1 · Answer 1 · answered Dec 22 '13 at 13:59

1

The -v switch gives you all the lines that don't match, so:

egrep -v 'HTTP[^"]*" (200|204)'

answered Dec 22 '13 at 13:59

Andrew Schulman

8,811
21
32
47

I want to do it in the regular expression itself. I need to feed a regex to a program that does the monitoring. – ddewaele Dec 22 '13 at 14:01
1

OK, then see my other answer. – Andrew Schulman Dec 22 '13 at 14:11

score 1 · Accepted Answer · answered Dec 22 '13 at 14:05

Ordinary regular expressions don't include a way to negate anything except a single character, so I think you'll have to provide the whole list of codes you do want:

HTTP[^"]*" (1|20[12356]|3|4|5)

Perl-compatible REs do allow you to negate strings of text, so if you were using those you could use

HTTP[^"]*" (?!(200|204))

Regular expression for monitoring HTTP errors in apache logs

2 Answers2