Apache Log Analysis Cheat Sheet
Use grep, awk, tail, sort and uniq to investigate Apache access logs, cPanel domlogs, status codes, top IPs and common website issues.
Common Apache and cPanel log paths
| Log | Path |
|---|---|
| Main Apache error log | /usr/local/apache/logs/error_log |
| Domain access log | /usr/local/apache/domlogs/example.com |
| Domain SSL log | /usr/local/apache/domlogs/example.com-ssl_log |
| User archived logs | /home/user/logs/ |
Find status codes
500 errors
grep " 500 " access.log404 errors
grep " 404 " access.log403 errors
grep " 403 " access.logCount status codes
awk '{print $9}' access.log | sort | uniq -c | sort -nrFind top IP addresses
Top IPs
awk '{print $1}' access.log | sort | uniq -c | sort -nr | headRequests from one IP
grep "^203.0.113.10 " access.logTop IPs for 404s
grep " 404 " access.log | awk '{print $1}' | sort | uniq -c | sort -nr | headTop login IPs
grep "wp-login.php" access.log | awk '{print $1}' | sort | uniq -c | sort -nr | headFind top URLs and heavy traffic
Top URLs
awk '{print $7}' access.log | sort | uniq -c | sort -nr | headTop 500 URLs
grep " 500 " access.log | awk '{print $7}' | sort | uniq -c | sort -nr | headLarge responses
awk '$10 > 1000000 {print $1, $7, $10}' access.logTotal bytes by IP
awk '{bytes[$1]+=$10} END {for (ip in bytes) print bytes[ip], ip}' access.log | sort -nr | headBot and crawler checks
Googlebot
grep -i "Googlebot" access.log | tailcurl requests
grep -i "curl" access.log | tailTop user agents
awk -F\" '{print $6}' access.log | sort | uniq -c | sort -nr | headWordPress-specific checks
wp-login hits
grep "wp-login.php" access.log | awk '{print $1}' | sort | uniq -c | sort -nr | headxmlrpc hits
grep "xmlrpc.php" access.log | awk '{print $1}' | sort | uniq -c | sort -nr | headadmin-ajax traffic
grep "admin-ajax.php" access.log | awk '{print $1, $7, $9}' | headLive checks
Watch SSL domlog
tail -f /usr/local/apache/domlogs/example.com-ssl_logWatch for 500s live
tail -f access.log | grep " 500 "Watch wp-login live
tail -f access.log | grep "wp-login.php"Apache log analysis workflows
Top IPs
awk '{print $1}' access.log | sort | uniq -c | sort -nr | headTop URLs
awk '{print $7}' access.log | sort | uniq -c | sort -nr | headStatus codes
awk '{print $9}' access.log | sort | uniq -c | sort -nrUser agents
awk -F\" '{print $6}' access.log | sort | uniq -c | sort -nr | headFrequently Asked Questions
What is an Apache access log?
It records requests made to the web server, commonly including IP, time, method, URL, status code and user agent.
How do I find top IPs in an access log?
Print the first field, then sort and count it with uniq -c.
How do I count HTTP status codes?
Print the status code field and count unique values.
Can Apache logs show bot traffic?
Yes. Request rate, URLs, IPs and user agents can all indicate bot activity.