Set Up: Understanding Raw Access Logs in cPanel
Raw Access Logs allow you to see who has visited your website without displaying graphs, charts, or other graphics.
You can use the Raw Access Logs menu in cPanel to download a zipped version of your website’s access log.
- Under Metrics select Raw Access.
- Under Download Current HTTP Access Logs, click on the domain you want to view. The raw access log will be downloaded to your local computer with a filename similar to accesslog_your-domain.com_7_7_2017.gz.
- Unzip the downloaded file and extract its contents with WinZip or WinRAR (or any program that extracts .gz files).
Understanding a Raw Access Log file:
Here is an example of what a typical raw access log may look like:
Here’s a brief description of each part of the data contained on each line of the file. We will use the first entry in the same log above as our example.
164.132.91.1 - - [07/Jul/2017:06:33:16 -0700] "GET / HTTP/1.1" 200 14132 "-" "Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0"
| 164.132.91.1 | IP address | The visitor’s IP address. |
| [07/Jul/2017:06:33:16 -0700] | Time Date stamp | This is the date and time the user visited your website. In this example, the visit occurred at 6:33 (AM) on July 7, 2017. Time is shown in military time format (hours are numbered from 00 to 23). |
| "GET / HTTP/1.1" | HTTP activity | What HTTP request the user sent to retrieve information from your website. GET (ie. content download) and POST (ie. comment upload) are the most common. |
| 200 14132 | Resource accesssed | Typically shows the relative path to a file, image or query the user viewed. The numerical value, 200 in this case, is a three-digit code that specifies the resulting status of the request. Typical values for this code are 200 (success), 302 (redirect) and 404 (not found). The number following the response code indicates the total size (in bytes) of data downloaded for the request (14132 bytes in our example). |
| "-" | Referrer | If any, indicates where the user was visiting from (the referrer URL). In this case, the user dropped in directly. |
| "Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0" | User agent | Identifies how the user is accessing your website. User agents are anything that can view and read web pages. Browsers and search spiders are the most common user agents. |
