Log Analysis for Top 5 IPs

MediumPython

Problem

Vercel access logs contain one request per line in the format timestamp ip status, separated by single spaces. Write a function that identifies the IP addresses generating the most server errors.

Count a request as an error when its HTTP status code is in the inclusive range 500 through 599. Return up to five IP addresses, ordered by decreasing 5xx request count. If multiple IPs have the same count, order those IPs lexicographically. Ignore the timestamp after parsing it, and assume every input line is valid.

Formal Specification

Input: logs, a list of non-empty strings. Each string has the format timestamp ip status, where timestamp contains no spaces, ip is an IPv4 or IPv6 address, and status is an integer HTTP status code.
Output: A list of at most five strings containing the qualifying IP addresses. An IP appears once, even if it triggers multiple errors.

Constraints

0 <= len(logs) <= 10^6
Each line contains exactly three space-separated fields
Status codes are integers from 100 through 599
Return no more than five IP addresses

Function Signature

def top_5xx_ips(logs):

Vercel access logs contain one request per line in the format timestamp ip status, separated by single spaces. Write a function that identifies the IP addresses generating the most server errors.

Formal Specification

Input: logs, a list of non-empty strings. Each string has the format timestamp ip status, where timestamp contains no spaces, ip is an IPv4 or IPv6 address, and status is an integer HTTP status code.
Output: A list of at most five strings containing the qualifying IP addresses. An IP appears once, even if it triggers multiple errors.