diff --git a/scripts/monitoring/log-monitor.sh b/scripts/monitoring/log-monitor.sh
index b832feaa..a24d4a00 100755
--- a/scripts/monitoring/log-monitor.sh
+++ b/scripts/monitoring/log-monitor.sh
@@ -113,22 +113,31 @@ extract_errors() {
 analyze_logs() {
   local logs="$1"
 
-  # Count different severity levels
-  local error_count=$(echo "$logs" | grep -ci "\[ERROR\]" || echo "0")
-  local critical_count=$(echo "$logs" | grep -ci "\[CRITICAL\]" || echo "0")
-  local warn_count=$(echo "$logs" | grep -ci "\[WARN\]" || echo "0")
+  # Count different severity levels (grep -c returns 0 if no matches, no need for fallback)
+  local error_count=$(echo "$logs" | grep -ci "\[ERROR\]" || true)
+  [[ -z "$error_count" ]] && error_count=0
+
+  local critical_count=$(echo "$logs" | grep -ci "\[CRITICAL\]" || true)
+  [[ -z "$critical_count" ]] && critical_count=0
+
+  local warn_count=$(echo "$logs" | grep -ci "\[WARN\]" || true)
+  [[ -z "$warn_count" ]] && warn_count=0
 
   # Security-related patterns
-  local security_count=$(echo "$logs" | grep -ciE "(SECURITY|unauthorized|forbidden|authentication failed)" || echo "0")
+  local security_count=$(echo "$logs" | grep -ciE "(SECURITY|unauthorized|forbidden|authentication failed)" || true)
+  [[ -z "$security_count" ]] && security_count=0
 
   # Database errors
-  local db_error_count=$(echo "$logs" | grep -ciE "(mongodb|database|connection.*failed)" || echo "0")
+  local db_error_count=$(echo "$logs" | grep -ciE "(mongodb|database|connection.*failed)" || true)
+  [[ -z "$db_error_count" ]] && db_error_count=0
 
   # HTTP errors
-  local http_error_count=$(echo "$logs" | grep -ciE "HTTP.*50[0-9]|Internal Server Error" || echo "0")
+  local http_error_count=$(echo "$logs" | grep -ciE "HTTP.*50[0-9]|Internal Server Error" || true)
+  [[ -z "$http_error_count" ]] && http_error_count=0
 
   # Unhandled exceptions
-  local exception_count=$(echo "$logs" | grep -ciE "(Unhandled.*exception|TypeError|ReferenceError)" || echo "0")
+  local exception_count=$(echo "$logs" | grep -ciE "(Unhandled.*exception|TypeError|ReferenceError)" || true)
+  [[ -z "$exception_count" ]] && exception_count=0
 
   log "INFO" "Log analysis: CRITICAL=$critical_count ERROR=$error_count WARN=$warn_count SECURITY=$security_count DB_ERROR=$db_error_count HTTP_ERROR=$http_error_count EXCEPTION=$exception_count"