You get a compressed archive of log files and must report how many entries failed and how many nearly failed, with no status field. How do you explore, define failure and count?

You are handed a .tar.gz archive of log files and asked how many log entries represent a failure and how many came close to failing. You must unpack it and work out the file and line formats yourself. The entries carry no success or failure label, so you must first settle what counts as a failure or a near failure (for example an execution time above some threshold) and then count.