Linux fundamentals
Linux Log Parsing Coding Interview Problem
Written and reviewed by Sahil Srivastav
What this interview round tests
Linux log parsing interviews show up in backend, SRE, platform, and DevOps screens because they test the work engineers actually do on a terminal: turn noisy production text into a small, reliable answer. The prompt may sound like "awk count requests by IP," but the grading is usually stricter than a one-liner copied from memory.
This challenge gives you a real shell repository with a failing test suite. You need to parse a web access log, report the busiest client IPs, and count server errors while keeping the output deterministic enough for an interview grader.
The scenario
You are on call and receive a raw Apache/nginx-style access log from a service that just had a traffic spike. The incident lead needs a compact triage report: which client IPs generated the most requests, and how many responses were 5xx server errors.
The starter script is intentionally incomplete. The tests encode the exact stdout contract, including ranking, formatting, and edge cases around status-code counting. Your job is to make the shell script produce the report without changing the fixtures or tests.
What you’ll practice
- Reading structured log lines with standard Linux text-processing tools
- Extracting the client IP and HTTP status fields without over-matching other text
- Counting repeated values and ranking the top request sources
- Using awk-style aggregation for interview-friendly log analysis
- Sorting numeric counts with deterministic tie-breaking so output is stable
- Keeping a shell solution small, reproducible, and easy to reason about under tests
How to approach it
Start from the failing tests and the fixture log. Identify which fields matter for the report, then build the script around those contracts: aggregate requests by client IP, rank the highest-volume clients, and compute the 5xx total from the status-code field rather than from arbitrary matches in the line.
Be deliberate about determinism. Shell pipelines often appear correct on a local sample while producing unstable ordering under ties, so make the sort order explicit and keep the final output format exactly aligned with the tests.
The starter repository ships with a failing test suite and a bundled verify.sh. Reviewed reference solutions are part of Gronex Pro — this page stays spoiler-free on purpose.
FAQ
Is this a realistic Linux log parsing interview problem?
Yes. It mirrors the common interview task of taking a raw access log and producing an on-call summary from the command line: top client IPs, request counts, and server-error volume. The difference is that you work in a repo with tests instead of describing the command verbally.
What Linux and shell skills does it test?
It focuses on field extraction, aggregation, numeric sorting, deterministic output, and careful status-code matching. Those are the same skills behind many "awk count requests by IP" and access-log triage interview prompts.
Do I need to install a Linux environment locally?
No. You can open the browser workspace and run the bundled shell tests there, or download the starter repo and run its verify script locally if you already have a shell and the test harness available.