Apache Log Files Explained: How to Read Access and Error Logs

The Two Logs: access_log vs error_log

The access log (access_log) records every request Apache processes — who asked, when, for which path, and the status sent back. A typical line reads: 203.0.113.9 - - [30/Oct/2026:10:14:02 +0530] "GET /pricing HTTP/1.1" 200 18421. The error log (error_log) records everything that went wrong — Apache faults, startup problems and PHP fatal errors — in the shape [date] [module:level] [pid] [client] message. Access logs answer "what happened"; error logs answer "why".

Three places, by setup:

1. cPanel hosting — ~/logs/ for the account's domains, or the per-domain logs directory in File Manager
2. VPS, Debian/Ubuntu — /var/log/apache2/access.log and error.log
3. VPS, RHEL family — /var/log/httpd/access_log and error_log

Virtual hosts can log to custom paths (check the CustomLog directive), and LiteSpeed hosting mirrors the same layout. From there, tail -f and grep turn raw lines into answers — the combined log format section below decodes each field. For PHP-level errors that never reach Apache, our PHP error logs guide picks up where error_log ends, and Linux hosting ships both log views in cPanel.

Reading the Combined Log Format Field by Field

The combined format is the standard seven Common Log Format fields plus two headers. Read a line left to right: %h is the client IP (behind a proxy it is the proxy address), %l is the RFC 1413 identity and is almost always a hyphen meaning "not available", %u is the authenticated user (hyphen on public pages), %t is the timestamp, and "%r" is the request line — method, path and protocol. %>s is the final status after any internal redirect (plain %s is the original), and %b is the bytes sent excluding headers. Combined adds %{Referer}i (the page the visitor came from) and %{User-agent}i (the browser or bot that made the request).

A worked example: 203.0.113.9 - - [30/Oct/2026:10:14:02 +0530] "GET /pricing HTTP/1.1" 200 18421 "https://google.com/" "Mozilla/5.0 (Windows NT 10.0)" — a visitor from Google on Windows fetched /pricing successfully and received 18,421 bytes.

Status Codes You’ll Actually See

Status codes sort into four families: 2xx success, 3xx redirection, 4xx the client’s fault, 5xx the server’s fault. One Apache 2.4 detail worth knowing: with the default LogLevel of warn, routine 404s are logged at info level and never reach error_log — the access log is where you count them.

Finding Problems: 404s, 500s, Bots

Start live: tail -f error_log while you reproduce the fault shows the failing entry as it happens. For 404s, grep the access log for the status and read the requested paths — grep ' 404 ' access_log — repeated paths point at dead links worth fixing. For 500s, take the timestamp and client IP from the access line, find the matching error_log entry, and read it: a PHP fatal error names the file and the line. For bots, group the user-agent field or grep for known crawler names, then count requests per IP to see which robots are eating your capacity.

Log Rotation and Retention

An access log grows by roughly 1 MB per 10,000 requests, so rotation is not optional. Apache’s bundled rotatelogs, wired through a piped CustomLog, rotates by time (86400 seconds) or by size (for example 100M) without a restart. Distro logrotate rotates on its own schedule, but Apache must be told to reopen its files afterwards with a graceful restart — apachectl graceful. On shared cPanel hosting the host manages rotation for you; the self-managed VPS is where you set it up yourself.

Analysis Tools: cPanel Metrics, grep, GoAccess

On WebJi® Linux hosting, cPanel’s Metrics section — Visitors, Raw Access Data and AWStats — turns the same access log into per-domain tables without SSH. On a VPS, grep and awk one-liners answer single questions fast, and GoAccess renders the access log into a live terminal dashboard of hits, status codes and top bots as the lines arrive. Match the tool to your access level: cPanel Metrics on shared plans, terminal tools when you have root.