In cPanel you can access your website’s raw access logs to see the traffic to your website, before it is turned into a report by statistics software. This is great for taking a closer look at the type of requests your site is getting.
To get the most out of your raw access logs, you would want to enable raw access log archiving in cPanel.
- Log into cPanel
Under the Metrics section, click on Raw Access
-
Click the domain you’d like to view stats for
-
Your browser should download the compressed raw access log
Once that has completed, use a program like 7zip to uncompress the files on your computer
-
Uncompress the file and open it
You will now see every request that your website had to deal with
If you just wanted to easily review your website traffic you could use something like AWStats in cPanel to do so.
If you have SSH access to your server, you can also learn about reviewing traffic from an Apache access log.
Am I incorrect in saying that if using a CDN, such as AWS, then edge data such as Awstats is more accurate than raw access logs – that raw access log data is obstructed by resources being served from cache by this node?
Thank you.
Hi Chris,
This question is a bit complicated and depends on the type of server you’re using for your website (from InMotion). Each server is cached, but the architecture is slightly different for the WordPress-optimized servers. If you were using a VPS (Virtual Private Server) or a Dedicated server, then the raw access log would be the better solution. In a shared environment, it’s a little more complicated. WordPress-optimized servers use NGINX for caching, so not all of the information is logged in the same place. NGINX has its own logs, as does the Apache server, so the Raw logs would not be as accurate in that situation. If you’re on a server that is not optimized for WordPress, then this would not be the case. The raw logs (for Apache) would be more accurate. I asked a Systems person in regards to the question and he also added: “Even if something is cached, it still has to have the content served so the instance would show in the access log.”
It is possible to download them via ssh. The “live” access logs are found at /home/<USERNAME>/access-logs/ and the archives are found in /home/<USERNAME>/logs/
Ben
Is there away to SSH in on command line and download the raw log files?
Hello Chris,
The logs are in an area you would not have access to using SSH.
Kindest Regards,
Scott M
That worked. Thanks, Jacob.
Hey Val,
Awesome! Glad that did the trick for you, thanks for commenting back and letting us know it worked. I’ll go ahead and mark this guide as needing to be updated to also reflect that as an option for getting to your raw access logs.
Let us know if you run into any further problems, we are constantly updating our content to try to provide the best solutions for any issues!
– Jacob
Great, but we have to log into cPanel to do this. I analyze my logs programatically, every day, to look for security issues, user activity, etc. Until some months ago this was easy because the raw log file for the day resided in a user-accessible folder that could be pulled by FTP. Now it’s spirited away in some place that tech support don’t know about or won’t talk about, so manual cPanel is the only method available. Unless I’m willing to download the entire month’s compressed log to pick out one day’s records. Sorry to be blunt but this is a step backwards. I’ve closed one hosting account due to this, and may do the same with another.
Hello Val,
I apologize for the inconvenience. The ability to FTP into the /access-logs directory does appear to be missing for the main cPanel users due to security restrictions on the server.
However you should be able to use the userna5_logs FTP user which should have the same password as your main FTP account, and has direct access into your website’s raw access logs. Obviously, replace userna5_ with your own cPanel username.
Please let us know if you’re still unable to access your raw access logs this way.
– Jacob