Download raw access logs
Get the unprocessed Apache log for your site, and configure archiving so the data is still there when you need it.
Raw Access gives you the server's own access log — every request, unsummarised. It is what you need when the graphs in Visitors or Awstats are not specific enough. Applies to shared, reseller and Premium hosting on cPanel.
Open Raw Access in cPanel under Metrics.
Download a log
Under Download Current Raw Access Logs, select the domain. HTTP and HTTPS
traffic are listed separately — example.com and example.com (SSL) — so
download both if you want the full picture.
The file is gzipped Apache combined-format: one line per request, with the client IP, timestamp, requested path, status code, referrer and user agent.
Raw logs may hold only a few hours of data. The system processes them into statistics every 24 hours and then discards the raw data. If you are investigating something that happened yesterday and archiving was off, the log is already gone.
Turn on archiving before you need it
Under Configure Logs:
| Setting | Effect |
|---|---|
| Archive log files to your home directory | Keeps the raw log after processing. Turn this on |
| Remove the previous month's archived logs | Deletes last month's archive each month |
| Set a custom retention period | Keeps archives for a number of days you choose |
Archiving is the setting that matters. Without it there is nothing to investigate after the fact.
Archived logs live in logs/ in your home directory and count towards your
disk quota. On a busy site they grow quickly, which is why the monthly removal
option exists — leave it on unless you have a reason to keep more, and see
Monitor disk usage.
Select Save after changing anything.
What to use them for
- Finding what a bot is hitting. Filter by user agent to see whether crawler traffic explains a load spike.
- Confirming an attack. Repeated POSTs to
wp-login.phpfrom one address are obvious in the raw log and invisible in a visitor graph. - Checking a redirect. The status code column shows exactly what the server returned.
For summarised traffic instead, use Visitors, Bandwidth or Awstats in the same Metrics section.
Related
Site Quality Monitoring
Turn on uptime and health monitoring for a domain from cPanel — what it scans, how often, and what the free allowance covers.
Fix a 503 "Resource Limit Reached" error
A 503 means your account hit its CPU, memory or entry process limit. How to find what is consuming them and bring usage back down.