If you have a log file with the following format:

date time loglevel [class] ...

e.g.:

2012-05-27 12:38:04,345 INFO [org.jboss.web.tomcat.service.TomcatDeployer] deploy, ctxPath=/hessian, warUrl=.../deploy/hessian.war/

and want to find out how many errors are generated per class, you can use the following:

 # grep " ERROR " jboss.log | awk '{ count[$4]++ } END { for(class in count) print class, count[class] }'
[org.jboss.aop.deployment.AspectDeployer] 1
[org.jboss.deployment.scanner.URLDeploymentScanner] 3
[org.jboss.remoting.transport.Connector] 1
[org.jboss.jdbc.DerbyDatabase] 3

Of course replace jboss.log by the path to the log file you want to analyze. If you do not want to group by the 4th component of the log file, change $4 to something else.

What it does is basically the following:

• grep ” ERROR ” jboss.log: extract only ERROR lines
• { count[$4]++ }: for each line in the file, get the 4th component and increase the count for this component. After you’ve gone through the whole file, you end up with an array containing the class as key and the count as value
• END { for(class in count) print class, count[class] }: when you’ve gathered data from the whole file, just go through the array and print the class and the count

If you want to sort by descending count, add a “sort -n -k2 -r”:

 # grep " ERROR " jboss.log | awk '{ count[$4]++ } END { for(class in count) print class, count[class] }' | sort -n -k2 -r
[org.jboss.jdbc.DerbyDatabase] 3
[org.jboss.deployment.scanner.URLDeploymentScanner] 3
[org.jboss.remoting.transport.Connector] 1
[org.jboss.aop.deployment.AspectDeployer] 1

• -n is used so that a numerical comparison is performed
• -k2 sorts using the second component i.e. the count
• -r sorts in descending order