Linux Tips

Count Error Occurrences in Linux Logs with Watch

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #85:

Question: How do I count error occurrences in Linux over time?

Try: watch -n 5 'grep -c "ERROR" /var/log/nginx/error.log'

Info: watch reruns commands at defined intervals (-n seconds) to track changing metrics. Coupling tail -f with awk increments and displays a live rolling tally as new log entries land.

Examples:

  • $ watch -n 1 -d 'grep -c ERROR /var/log/app.log'  # Highlight changing match values automatically
  • $ tail -f app.log | grep --line-buffered ERROR | wc -l  # Count streaming lines without buffering lag
  • $ journalctl -f -u nginx | grep --line-buffered -c "ERROR"  # Stream systemd journal logs live

Note: Add --line-buffered to grep when piping live streams to prevent stdio buffer delay. Use watch -d to visually highlight value differences between interval updates.




LinuxTeck.com 
linuxteck:~$ watch -n 5 'grep -c "ERROR" /var/log/nginx/error.log'
Every 5.0s: grep -c "ERROR" /var/log/nginx/error.log

234


linuxteck:~$ tail -f /var/log/nginx/error.log | awk '/ERROR/ {count++; print strftime("%H:%M:%S"), "Total errors:", count}'
10:23:45 Total errors: 1
10:23:47 Total errors: 2
10:23:51 Total errors: 3
10:24:12 Total errors: 4
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #84: Perf Trace: Analyze System Calls on Linux NEXT ARTICLE Quick Linux Tip #86: Linux File Attributes: Find and Remove Immutable Flags
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.