Given log entries, count errors per minute and return them sorted by time.

• Null input returns an empty list.
• Only exact level Error counts.
• Timestamps are normalized to UTC before bucketing.
• Output is sorted by minute ascending.

I would filter to error entries, convert timestamps to UTC, truncate seconds and smaller units, then group by that minute. I would return a DTO rather than exposing raw grouping types. This mirrors real observability tasks where exact bucket boundaries and deterministic ordering matter.

public sealed record LogEntry(DateTimeOffset Timestamp, string Level, string Message);
public sealed record ErrorBucket(DateTimeOffset Minute, int Count);

public static IReadOnlyList<ErrorBucket> CountErrorsByMinute(IEnumerable<LogEntry>? logs)
{
    if (logs is null)
    {
        return Array.Empty<ErrorBucket>();
    }

    static DateTimeOffset TruncateToUtcMinute(DateTimeOffset timestamp)
    {
        var utc = timestamp.ToUniversalTime();
        return new DateTimeOffset(
            utc.Year,
            utc.Month,
            utc.Day,
            utc.Hour,
            utc.Minute,
            0,
            TimeSpan.Zero);
    }

    return logs
        .Where(log => string.Equals(log.Level, "Error", StringComparison.Ordinal))
        .GroupBy(log => TruncateToUtcMinute(log.Timestamp))
        .OrderBy(group => group.Key)
        .Select(group => new ErrorBucket(group.Key, group.Count()))
        .ToList();
}

The grouping pass is O(n). Sorting buckets is O(k log k), where k is the number of minute buckets. Space is O(k).

• Null or empty logs.
• No error logs.
• Multiple errors in the same minute.
• Different offsets representing the same UTC minute.
• Case sensitivity of the level value.

• Use 10:05:00 and 10:05:59 to catch truncation.
• Use different time zones for the same instant.
• Use error lower-case if the rule says exact Error only.

• Grouping by full timestamp instead of minute.
• Ignoring time zone normalization.
• Counting non-error levels.
• Returning unordered buckets.