# Download raw access logs
Source: https://docs.webgee.com/en/performance/raw-access-logs





**Raw Access** gives you the server's own access log — every request, unsummarised.
It is what you need when the graphs in Visitors or Awstats are not specific
enough. Applies to shared, reseller and Premium hosting on cPanel.

Open **Raw Access** in cPanel under **Metrics**.

<img alt="The Raw Access page, showing log configuration and the per-domain download list" src="__img0" />

## Download a log [#download-a-log]

Under **Download Current Raw Access Logs**, select the domain. HTTP and HTTPS
traffic are listed separately — `example.com` and `example.com (SSL)` — so
download both if you want the full picture.

The file is gzipped Apache combined-format: one line per request, with the
client IP, timestamp, requested path, status code, referrer and user agent.

<Callout type="warn">
  Raw logs may hold only **a few hours** of data. The system processes them into
  statistics every 24 hours and then discards the raw data. If you are
  investigating something that happened yesterday and archiving was off, the log
  is already gone.
</Callout>

## Turn on archiving before you need it [#turn-on-archiving-before-you-need-it]

Under **Configure Logs**:

| Setting                                       | Effect                                           |
| --------------------------------------------- | ------------------------------------------------ |
| **Archive log files to your home directory**  | Keeps the raw log after processing. Turn this on |
| **Remove the previous month's archived logs** | Deletes last month's archive each month          |
| **Set a custom retention period**             | Keeps archives for a number of days you choose   |

Archiving is the setting that matters. Without it there is nothing to
investigate after the fact.

Archived logs live in `logs/` in your home directory and **count towards your
disk quota**. On a busy site they grow quickly, which is why the monthly removal
option exists — leave it on unless you have a reason to keep more, and see
[Monitor disk usage](/en/hosting/monitoring-disk-usage-with-cpanel).

Select **Save** after changing anything.

## What to use them for [#what-to-use-them-for]

* **Finding what a bot is hitting.** Filter by user agent to see whether crawler
  traffic explains a load spike.
* **Confirming an attack.** Repeated POSTs to `wp-login.php` from one address are
  obvious in the raw log and invisible in a visitor graph.
* **Checking a redirect.** The status code column shows exactly what the server
  returned.

For summarised traffic instead, use **Visitors**, **Bandwidth** or **Awstats**
in the same Metrics section.

## Related [#related]

* [Monitor disk usage with cPanel](/en/hosting/monitoring-disk-usage-with-cpanel)
* [Diagnose a slow website with PHP X-Ray](/en/performance/diagnose-slow-site-php-xray)