Log File Analyzer - Problem

You are building a log analysis tool for a web server. Given an array of web server log lines, parse each line to extract the IP address, timestamp, URL path, and HTTP status code.

After parsing all log lines, generate a summary report containing:

The top 3 IP addresses by request count (most frequent first)
The overall error rate as a percentage (status codes 400-599 are errors)

Each log line follows this format:

IP - - [timestamp] "GET /path HTTP/1.1" status_code size

Example: 192.168.1.1 - - [10/Oct/2023:13:55:36] "GET /api/users HTTP/1.1" 200 1234

Return the result as an object with topIPs (array of IP strings) and errorRate (number rounded to 1 decimal place).

Input & Output

Example 1 — Basic Web Server Logs

$ Input: logs = ["192.168.1.1 - - [10/Oct/2023:13:55:36] \"GET /api/users HTTP/1.1\" 200 1234", "10.0.0.1 - - [10/Oct/2023:13:56:10] \"POST /api/login HTTP/1.1\" 404 567", "192.168.1.1 - - [10/Oct/2023:13:57:22] \"GET /dashboard HTTP/1.1\" 500 890"]

› Output: {"topIPs": ["192.168.1.1", "10.0.0.1"], "errorRate": 66.7}

💡 Note: 192.168.1.1 appears 2 times (most frequent), 10.0.0.1 appears 1 time. Out of 3 requests, 2 have error status codes (404, 500), so error rate is 2/3 = 66.7%

Example 2 — All Successful Requests

$ Input: logs = ["203.0.113.1 - - [10/Oct/2023:14:00:00] \"GET /home HTTP/1.1\" 200 2048", "203.0.113.1 - - [10/Oct/2023:14:01:00] \"GET /about HTTP/1.1\" 301 512"]

› Output: {"topIPs": ["203.0.113.1"], "errorRate": 0.0}

💡 Note: Only one unique IP with 2 requests. Both status codes (200, 301) are successful (not in 400-599 range), so error rate is 0%

Example 3 — Multiple IPs with Ties

$ Input: logs = ["192.168.1.1 - - [10/Oct/2023:15:00:00] \"GET /api HTTP/1.1\" 200 1024", "10.0.0.1 - - [10/Oct/2023:15:01:00] \"POST /submit HTTP/1.1\" 403 256", "172.16.0.1 - - [10/Oct/2023:15:02:00] \"GET /data HTTP/1.1\" 200 3072"]

› Output: {"topIPs": ["192.168.1.1", "10.0.0.1", "172.16.0.1"], "errorRate": 33.3}

💡 Note: Three IPs each appear once (3-way tie). One error status code (403) out of 3 total requests gives error rate of 1/3 = 33.3%

Constraints

0 ≤ logs.length ≤ 10⁴
Each log line follows the format: IP - - [timestamp] "METHOD /path HTTP/1.1" status_code size
IP addresses are valid IPv4 format
Status codes are 3-digit integers (100-599)
Error status codes are in range 400-599

Visualization

Tap to expand

Asked in

a Amazon 45 G Google 38 M Microsoft 32 f Meta 28

The key insight is to process each log entry exactly once while simultaneously building an IP frequency map and tracking error counts. The optimal approach uses a hash map for O(1) IP counting and maintains running totals for error rate calculation. Best approach: Single Pass with Hash Map - Time: O(n log k), Space: O(k) where k is unique IPs.

Common Approaches

✓ Brute Force - Multiple Scans

⏱️ Time: O(n²) Space: O(n)

Parse each log line to extract IP and status code, store in arrays. For each unique IP, scan through all entries to count occurrences. Separately scan all status codes to count errors.

Single Pass with Hash Map

⏱️ Time: O(n log k) Space: O(k)

Process each log line exactly once, extracting IP and status code. Use a hash map to track IP frequencies and maintain running counters for total requests and errors.

Brute Force - Multiple Scans — Algorithm Steps

Parse each log line to extract IP address and status code
For each unique IP, scan entire list to count occurrences
Sort IPs by count and take top 3
Scan all status codes to count errors and calculate rate

Visualization

Tap to expand

Step-by-Step Walkthrough

Parse Logs

Extract IP addresses and status codes from each log line

Count IPs

For each unique IP, scan entire list to count occurrences

Generate Report

Sort IPs by frequency, calculate error rate from status codes

Code -

solution.c — C

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <math.h>

#define MAX_LOGS 1000
#define MAX_LINE 2000
#define MAX_IP 20

typedef struct {
    char ip[MAX_IP];
    int count;
} IPCount;

void solution(char logs[][MAX_LINE], int logCount) {
    if (logCount == 0) {
        printf("{\"topIPs\":[],\"errorRate\":0.0}\n");
        return;
    }
    
    char ips[MAX_LOGS][MAX_IP];
    int statusCodes[MAX_LOGS];
    int ipCount = 0, statusCount = 0;
    
    // Parse each log line
    for (int i = 0; i < logCount; i++) {
        // Extract IP (everything before first space)
        char* spacePos = strchr(logs[i], ' ');
        if (spacePos != NULL) {
            int ipLen = spacePos - logs[i];
            strncpy(ips[ipCount], logs[i], ipLen);
            ips[ipCount][ipLen] = '\0';
            ipCount++;
        }
        
        // Extract status code (look for pattern after quote)
        char* quotePos = strrchr(logs[i], '"');
        if (quotePos != NULL) {
            int status;
            if (sscanf(quotePos + 1, " %d", &status) == 1) {
                statusCodes[statusCount++] = status;
            }
        }
    }
    
    // Brute force: count each IP by scanning entire list
    IPCount ipCounts[MAX_LOGS];
    int uniqueCount = 0;
    
    for (int i = 0; i < ipCount; i++) {
        // Check if IP already counted
        int found = 0;
        for (int j = 0; j < uniqueCount; j++) {
            if (strcmp(ipCounts[j].ip, ips[i]) == 0) {
                found = 1;
                break;
            }
        }
        
        if (!found) {
            strcpy(ipCounts[uniqueCount].ip, ips[i]);
            ipCounts[uniqueCount].count = 0;
            
            // Count occurrences by scanning entire list
            for (int j = 0; j < ipCount; j++) {
                if (strcmp(ips[i], ips[j]) == 0) {
                    ipCounts[uniqueCount].count++;
                }
            }
            uniqueCount++;
        }
    }
    
    // Sort by count (bubble sort)
    for (int i = 0; i < uniqueCount - 1; i++) {
        for (int j = 0; j < uniqueCount - i - 1; j++) {
            if (ipCounts[j].count < ipCounts[j + 1].count) {
                IPCount temp = ipCounts[j];
                ipCounts[j] = ipCounts[j + 1];
                ipCounts[j + 1] = temp;
            }
        }
    }
    
    // Calculate error rate
    int errorCount = 0;
    for (int i = 0; i < statusCount; i++) {
        if (statusCodes[i] >= 400 && statusCodes[i] <= 599) {
            errorCount++;
        }
    }
    
    double errorRate = statusCount > 0 ? 
        (double)errorCount / statusCount * 100 : 0.0;
    errorRate = round(errorRate * 10.0) / 10.0;
    
    // Print result
    printf("{\"topIPs\":[");
    int printCount = uniqueCount < 3 ? uniqueCount : 3;
    for (int i = 0; i < printCount; i++) {
        printf("\"%s\"", ipCounts[i].ip);
        if (i < printCount - 1) printf(",");
    }
    printf("],\"errorRate\":%.1f}\n", errorRate);
}

int main() {
    char line[MAX_LINE * 10];
    fgets(line, sizeof(line), stdin);
    line[strcspn(line, "\n")] = 0;
    
    // Parse JSON array manually
    char logs[MAX_LOGS][MAX_LINE];
    int logCount = 0;
    
    if (strlen(line) > 2) {
        char* start = line + 1; // Skip [
        char* end = line + strlen(line) - 1; // Skip ]
        *end = '\0';
        
        char* token = strtok(start, "\"");
        while (token != NULL && logCount < MAX_LOGS) {
            if (strlen(token) > 1 && token[0] != ',' && token[strlen(token)-1] != ',') {
                strcpy(logs[logCount], token);
                logCount++;
            }
            token = strtok(NULL, "\"");
        }
    }
    
    solution(logs, logCount);
    return 0;
}

Time & Space Complexity

Time Complexity

⏱️

O(n²)

For each unique IP, we scan through all n log entries to count occurrences

⚠ Quadratic Growth

Space Complexity

O(n)

Store parsed IPs and status codes in separate arrays

⚡ Linearithmic Space

89.2K Views

High Frequency

~25 min Avg. Time

1.8K Likes

Ln 1, Col 1

Smart Actions

💡 Explanation

AI Ready

💡 Suggestion Tab to accept Esc to dismiss

// Output will appear here after running code

Code Editor Closed

Click the red button to reopen

Log File Analyzer - Problem

Input & Output

Constraints

Visualization

Related Problems

Common Approaches

Brute Force - Multiple Scans — Algorithm Steps

Visualization

Code -

Time & Space Complexity

Select Compiler