So you want to snoop some PFS:
So there are a few different ways to do this. But some of the things you are asking for you need more of the picture to discern. We'll look at the one you're proposing: break-and-inspect.
Break and inspect
Break-and-inspect requires we be able to crack open the TLS, and EC(DH) ciphers are designed to be resistant to MITM. There was a great post a while back that went over the limitations (Decrypting TLS in Wireshark when using DHE_RSA ciphersuites.) tl;dr, you need the pre-master keys from your application and a way to consume them.
Another way to break-and-inspect is to move the TLS termination point to a device you can instrument (a apache/nginx proxy of some sort.) If you have another device proxying requests on your behalf you could then inspect that traffic through the proxy's application.
Ask the Server
Finally the way I would attempt to do this is: I would look to the webserver itself. Almost all of the information you mentioned (4XXs, URI logs, tcp session timeouts etc.) can be gleaned from webserver logs.
If we have to perform this activity without any break and inspect, or access to webserver logs, and I had no end of time, I might try and (https://www.scip.ch/en/?labs.20160317) implement a practical Bicycle attack since I have access to the unencrypted text for things like 404 pages etc. You wouldn't be able to get meaningful information about the errors, only confidence that there were errors etc. Any sort of network inspection will capture TCP/IP level disconnects etc but you still will be limited to what you can actually see.