heisentest → guides

How to analyze nginx access logs (without a log platform)

Something spiked at 02:14 and you have access.log — a few hundred thousand lines of combined log format. The questions are always the same: when did errors start, which endpoints, how bad, and what happened around them.

Quick answers with awk and sort

# count by status code
awk '{print $9}' access.log | sort | uniq -c | sort -rn

# all 5xx lines
awk '$9 ~ /^5/' access.log

# top requested paths
awk '{print $7}' access.log | sort | uniq -c | sort -rn | head

For standing dashboards, GoAccess builds a full report from the terminal. Both approaches share one gap: they aggregate. Seeing the shape of an incident — errors ramping over 90 seconds, then a burst, then recovery — means reading timestamps by eye.

Seeing the incident instead

Drop access.log on heisentest: the combined log format is detected automatically, 5xx become ERROR, 4xx become WARN, and the whole file turns into a timeline where the spike is simply visible. Click the spike, read the exact requests. Then drop the application log next to it — both files merge onto one clock, so you can see what the app did in the seconds before the gateway started returning 502s.

It runs entirely in your browser: no upload, no account, works offline.

Try it: heisentest.com — the built-in sample incident is exactly this scenario: an app OOM followed three seconds later by a gateway 502 storm.

Honest limits

heisentest reads the file you give it; it does not tail a remote server. For live dashboards over streaming traffic you want GoAccess or a hosted platform. For the post-incident file in your hands, the browser is faster to answers.