How to View Raw Access Logs in cPanel

When you want to review detailed visitor request logs for your website. This article explains how to access raw access logs in cPanel.

Raw Access Logs allow you to see who has visited your website. You can check the Raw Access Logs menu in cPanel to download a zipped version of your website’s access log.

Please follow the steps mentioned below:

1. Under the Metrics option in cpanel select Raw access.

wse_image1

2. Click on the domain you want to view. The raw access log will be downloaded to your local computer with a filename similar to accesslog_your-domain.com_date.gz. Unzip the downloaded file and extract its contents with WinZip or WinRAR (or any program that extracts .gz files).

wse_image1

Understanding a Raw Access Log file:

Here is an example of what a typical raw access log may look like:

96.125.163.16 - - [26/Feb/2020:09:43:06 -0600] "GET /.well-known/acme-challenge/IZ_1I7QIIYOX8BEH36LNG2SE2MDLLEU1 HTTP/1.1" 200 64 "-" "Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0"

Here’s a brief description of each part of the data contained on each line of the file.

96.125.163.16	IP address	The visitor’s IP address.
[26/Feb/2020:09:43:06 -0600]	Time Date stamp	This is the date and time the user visited your website. Time is shown in military time format (hours are numbered from 00 to 23).
"GET --/ HTTP/1.1"	HTTP activity	What HTTP request the user sent to retrieve information from your website. GET (ie. content download) and POST (ie. comment upload) are the most common.
200 64	Resource accessed	Typically shows the relative path to a file, image or query the user viewed. The numerical value, 200 in this case, is a three-digit code that specifies the resulting status of the request. Typical values for this code are 200 (success), 302 (redirect) and 404 (not found). The number following the response code indicates the total size (in bytes) of data downloaded for the request .
"-"	Referrer	If any, indicates where the user was visiting from (the referrer URL). In this case, the user dropped in directly.
"Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0"	User agent	Identifies how the user is accessing your website. User agents are anything that can view and read web pages. Browsers and search spiders are the most common user agents.

Did you find this article helpful?