Raw Access Logs in cPanel
Raw access logs are text files that contain information about your website's visitors and the content on your website that they have accessed.
Graphical tools such as AWStats use the data from these logs to create the charts and graphs you see in those tools.
The information contained in the raw access logs includes: user agents, IP addresses, HTTP activity, and resources accessed by each visitor (explained in more detail below).
To access the raw logs interface go to cPanel > Metrics and click Raw Access link:
cPanel will start saving the logs in your account only if you check mark the box in front of the text: "Archive logs in your home directory at the end of each stats run every 48 hours".
If you check mark the box in front of the text: "Remove the previous month's archived logs from your home directory at the end of each month" , cPanel will list all old logs in a Archived Raw Logs table.
Download Current Raw Access Logs
In this section all available logs are listed in a table containing next information:
- Domain: list of the domains in your account
- Last Update: the latest date when the log was updated
- Disk Usage: the amount of the disk space the log file takes
- Linked Domains: list of the addon/parked domains
Click the domain name that corresponds to the raw access log that you want to download. Once downloaded, you can extract the file locally and view its content using any text editor.
If you wish to download archived logs which are stored in the account home directory, click on the corresponding one in the Archived Raw Logs section:
How to read the information in the access logs
The server access log records all requests processed by the server in specified format:
127.0.0.1 - - [16/Sep/2017:20:31:47 +0300] "GET /server/apache.jpg HTTP/1.0" 200 19426 "http://hostpulse-demo.com/server/access-logs.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36 OPR/47.0.2631.80"
Each part of the log entry is described below:
The IP address of the client (remote host) - 127.0.0.1;
The userid of the person requesting the document as determined by HTTP
authentication - cpaneluser. The "hyphen" in the output indicates that the requested piece of information is not available -
The time that the request was received - [16/Sep/2017:20:31:47 +0300];
The request line from the client is given in double quotes:
- the method used by the client is GET - GET;
- the client requested relative path to resource -
- the used protocol - HTTP/1.0;
The status code that the server sends back to the client - 200 success (might be also 403 forbidden, 404 not found, etc.);
The size of the object returned to the client - 19426;
"Referer" - the site that the client reports having been referred from. (This should be the page that links to or includes
"User-Agent" - the identifying information that the client browser reports about itself - "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36 OPR/47.0.2631.80";
Activate the logging in your cPanel account by checking the check boxes in the Raw Access interface. If you need logs but there are no archives in your account contact the support department.
The web server logs all user activities and all requested resources in the access log file and this file usually contains thousands of lines of information.
The normal troubleshooting practice is to check carefully the information in a statistics program like AWStats and then to find the detailed information about that user or file or action in the logs using text editor with good search capabilities (like Notepad++).