Enabling raw access log archiving in cPanel

In this article we’ll discuss the ability to archive your raw access logs so that you can investigate the requests happening on your website at a later date. By default statistics update every 24-36 hours on the server, and when they are run all of your requests for that time period are compiled into a statistics report that you can view with either Awstats, Logaholic, or Webalizer.

However if you needed to go back and see exact requests that had happened, these are wiped out each time statistics reporting is run. So the only thing you’re left with is the compiled statistics reports that you can view from cPanel. In most cases this is fine, but if you did need to see the exact requests for a particular day you can set your account up to archive your raw access logs. This way that data is retained just in case you did need to go back and do a manual investigation at some point.

If you have root access to a VPS or dedicated server, you can also enable raw access log archiving for all cPanel accounts at once.

1. Login to your cPanel.
2. Under the Metrics section, click on Raw Access.
   
3. Place a checkmark beside Archive logs in your home directory at the end of each stats run every 24 hours.
4. Only place a checkmark beside Remove the previous month’s archived logs from your home directory at the end of each month, if you would only like to archive the current month’s logs and not keep previous month’s logs.
5. Click on Save.
   
6. With your new settings saved, now click on Go Back.
   
7. Under the Download Current Raw Access Logs section, if you click on your domain, this will download the most recent raw access log, typically showing just todays activity.
   
8. Under the Archived Raw Logs section you can click on older archived logs to download them to your computer.
   

You should now know how to enable raw access log archiving for your account. Your can read our accessing the raw access logs in cPanel article for a bit more information on what to do once you’ve downloaded a raw access log.