How to View Apache Access & Error Logs
Apache is part of the LAMP stack of software for Linux (Linux, Apache, MySQL, PHP). Apache is responsible for serving web pages to people looking at your website.
The server grants access for visits to your website, and it keeps an access log. These records, or log files, can be a valuable source of information about your website, usage, and audience.
In this tutorial, you will learn how to view Apache access log files.
- A Linux system running Apache web services
- A user account with root (sudo) access
- Terminal window (Ctrl-Alt-T in Ubuntu, Alt-F2 in CentOS)
Viewing Apache Access Logs
Use cPanel to Download Raw Access Files
If you’re logged in to a web server with cPanel, you can download the Apache access logs through a graphical interface.
1. Look for the section labeled Metrics.
2. Click Raw Access. If archiving is enabled, raw Apache log files can be downloaded at the bottom of the page. They will look like standard hyperlinks, labeled for the website you’re managing.
Clicking the hyperlink will prompt you to save or open the file. These log files are compressed using gzip, so if you’re not using a Linux system, you might need a decompression tool. Save the file to a location of your liking.
3. Locate the file in your OS, then right-click > extract. A new file should appear without the .gz extension.
4. Right-click > edit to open the file in your favorite text editor to view the contents.
Using Terminal Commands to Display Local Access Logs
If you’re working on the machine that hosts Apache, or if you’re logged into that machine remotely, you can use the terminal to display and filter the contents of the access logs.
By default, you can find the Apache access log file at the following path:
- /var/log/apache/access.log
- /var/log/apache2/access.log
- /etc/httpd/logs/access_log
Use the GUI or the terminal with the cd command to navigate your system to find where the logs are stored.
Step 1: Display the Last 100 Entries of the Access Log
In the terminal window, enter the following:
The tail command tells the machine to read the last part of the file, and the -100 command directs it to display the previous 100 entries.
The final part, /var/log/apache2/access.log tells the machine where to look for the log file. If your log file is in a different place, make sure to substitute your machine’s path to the Apache log files.
Step 2: Display a Specific Term from Access Logs
Sometimes, you only want to display a specific type of entry in the log. You can use the grep command to filter your report by certain keywords.
For example, enter the following into a terminal:
Like the previous command, this looks at the /var/log/apache2/access.log file to display the contents of the access log. The grep command tells the machine to only display entries with the GET request.
You can substitute other Apache commands as well. For example, if you’re looking to monitor access to .jpg images, you could substitute .jpg for GET . As before, use the actual path to your server’s log file.
How to View Apache Error Logs
In addition to the access log, you can use the previously mentioned terminal commands to view the error log.
Enter the following command in the terminal:
If you found your access log file in another location, your error log file will be in the same location. Make sure you type the correct path.
Interpreting the Access Log in Apache
When you open your access log file for the first time, you may feel overwhelmed.
There’s a lot of information about HTTP requests, and some text editors (and the terminal) will wrap the text to the next line. This can make it confusing to read, but each piece of information is displayed in a specific order.
The conventional method for expressing the format of access log files is:
This is a code for the most common things in each line of the log.
Each % sign corresponds to a piece of information in the log:
- %h – The client’s IP address (the source of the access request).
- %l – This next entry may simply be a hyphen — that means no information was retrieved. This is the result of checking identd on the client.
- %u – Client’s userid , if the access request required http authentication.
- %t – Timestamp of the incoming request.
- %r – Request line that was used. This tells you the http method (GET, POST, HEAD, etc.), the path to what was requested, and the http protocol being used.
- %>s – Status code that was returned from the server to the client.
- %b – Size of the resource that was requested.
- "%
i" – This tells you if the access came from clicking a link on another website, or other ways that the client was referred to your page. - "%
i" – Tells you information about the entity making the request, such as web browser, operating system, website source (in the case of a robot), etc.
Just read across the line in your log file, and each entry can be decoded as above. If there is no information, the log will display a hyphen. If you’re working on a preconfigured server, your log file may have more or less information. You can also create a custom log format by using the custom log module.
For more information about decoding log formats, see this page.
How to Use Data in Apache Log Files
Apache log analysis gives you the opportunity to measure the ways that clients interact with your website.
For example, you might look at a timestamp to figure out how many access requests arrive per hour to measure traffic patterns. You could look at the user agent to find out if particular users are logging in to a website to access a database or create content. You could even track failed authentications to monitor various types of cybersecurity attacks against your system.
The apache error log can be used similarly. Often, it’s simply used to see how many 404 errors are being generated. A 404 error happens when a client requests a missing resource, and this can alert you on broken links or other errors within the page. However, it can also be used to find configuration glitches or even warnings about potential server problems.
This guide provided methods for extracting data to view Apache access log files.
How Do I Analyze Apache Log Files
The Apache access.log is the most crucial one when using the Apache Web server because it contains a collection of events on the Apache webserver, providing detailed server utilization and errors.
This tutorial will look at various ways to comb through the apache log file to find and locate relevant information.
Access Log Location
The location of the access.log can vary depending on the operating system and the value of the CustomLog directive.
By default, you will find the access log stored in /var/log/apache2/access.log (Debian and Ubuntu). On Fedora, CentOS and REHL, you’ll find the file stored in /var/log/httpd/access_log
Finding Information Using HTTP codes
The simplest way to gather information from the Apache access log is to use tools like cat, less, and grep.
For example, to gather information on a specific HTTP code, we can enter the command:
The command above will search the access.log file for HTTP code 200. Below is an example output:
172.25.64.1 — — [ 10 / Sep / 2021 : 12 : 18 : 47 +0300 ] "GET / HTTP/1.1" 200 3380
"-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36"
172.25.64.1 — — [ 10 / Sep / 2021 : 12 : 18 : 47 +0300 ] "GET /icons/openlogo-
75.png HTTP/1.1" 200 6040 "http://172.25.66.206/" "Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
We can also tie two commands and grab for more specific information. For example, we can grab the IP addresses that return the 200 OK status code as:
An example output is below:
How to Analyze Logs Using GoAccess
Although manually finding information in Apache access.log file is adequate for small tasks, it quickly becomes cumbersome for a server with thousands of requests. It also does not offer a real-time information view for the logs.
In such a case, we can use a simple tool such as goaccess to analyze logs in real-time.
To install the package, enter the command:
Once installed, launch the utility and point it to the access.log. Here’s an example command:
GoAccess will parse the access.log file and dump detailed and well-organized data about the web server logs.
You can open the file by navigating to http://SERVER_ADDRESS/report.html where the server address is the address under which Apache is running. You should see a sample dashboard such as the one shown below:
Using the GoAccess web interface, you can filter for specific information such as 404 URL, operating system information, browser information, and more.
GoAccess also allows you to export the logs as JSON to parse to tools such as Grafana and Logstash.
TIP: If you are on a Windows system, you can use a tool like the Apache HTTP Log Viewer to analyze and filter specific log entries.
Conclusion
In this guide, we discussed two simple steps to analyze Apache logs. If you are looking for a more visual and detailed method, check out our visualizing Apache Logs with ELK stack.
Thank you for reading!
About the author
John Otieno
My name is John and am a fellow geek like you. I am passionate about all things computers from Hardware, Operating systems to Programming. My dream is to share my knowledge with the world and help out fellow geeks. Follow my content by subscribing to LinuxHint mailing list
How To Troubleshoot Common Apache Errors
There are three main commands, and a set of common log locations that you can use to get started troubleshooting Apache errors. Generally when you are troubleshooting Apache, you will use these commands in the order indicated here, and then examine log files for specific diagnostic data.
The commands that you will commonly use to troubleshoot Apache across most Linux distributions are:
- systemctl — Used to control and interact with Linux services via the systemd service manager.
- journalctl — Used to query and view the logs that are generated by systemd .
- apachectl — When troubleshooting, this command is used to check Apache’s configuration.
These commands, how to use them, and Apache’s log locations where you can find additional information about errors are described in further detail in the following sections.
Note: On Debian and Ubuntu systems, the Apache service and process name is apache2 , whereas on CentOS, Fedora, and other RedHat-derived systems, Apache’s service and process name is httpd . Apart from the differences between the service and running process names, starting, stopping, and checking Apache’s status, as well as logs with journalctl should work the same on any Linux system that uses systemd to manage the Apache service. Be sure to use the correct name for your Linux distribution.
systemctl Commands for Apache
To troubleshoot common Apache errors using the systemd service manager, the first step is to inspect the state of the Apache processes on your system. The following systemctl commands will query systemd for the state of Apache’s processes.
On Ubuntu and Debian systems run:
The -l flag will ensure that output is not truncated or ellipsized. The —no-pager flag will make sure that output will go directly to your terminal without requiring any interaction on your part to view it. You should receive output like this:
To inspect the Apache process on CentOS and Fedora systems run:
You should receive output like this:
In either case, make a note of the Active line in the output. If your Apache server does not show active (running) as highlighted in the previous examples but you expect it should, there may be an error. Typically if there is a problem, you will have a line like the following in your output (note the highlighted failed portion):
If there is a problem with your Apache process or configuration you can troubleshoot it further using the journalctl command.
journalctl Commands for Apache
To inspect the systemd logs for Apache, you can use the journalctl command. The systemd logs for Apache will usually indicate whether there is a problem with starting or managing the Apache process.
These logs are separate from Apache’s request and error logs. journalctl displays logs from systemd that describe the Apache service itself, from startup to shutdown, along with any process errors that may be encountered along the way.
On Ubuntu and Debian systems use the following command to examine the logs:
The —since today flag will limit the output of the command to log entries beginning at 00:00:00 of the current day only. Using this option will help restrict the volume of log entries that you need to examine when checking for errors. You should receive output like the following:
If you are using a CentOS or Fedora based system, use this version of the command:
You should receive output like the following:
If there is an error, you will have a line in the output that is similar to the following, with the main difference between Linux distributions being the highlighted yourhostname portion:
If your Apache server has errors in the journalctl logs like the previous example, then the next step to troubleshoot possible issues is investigating Apache’s configuration using the apachectl command line tool.
Troubleshooting with apachectl
Most Linux distributions include the apachectl utility with Apache. apachectl is an invaluable tool to help detect and diagnose Apache configuration problems.
To troubleshoot issues using apachectl , test your Apache configuration using the apachectl configtest command. The tool will parse your Apache files and detect any errors or missing settings before attempting to start the server.
Run the command like this on Ubuntu, Debian, CentOS, and Fedora based distributions:
A working Apache configuration will result in output like the following:
Depending on your Linux distribution, there may be other lines mixed in with the output, but the important line is the one that says Syntax OK .
If there is an error in your Apache configuration, like a directive that references a module that is not enabled or even a single typo, apachectl will detect it and attempt to notify you about the problem.
For example, attempting to use directives for an Apache module that is not enabled will result in apachectl configtest messages like the following:
In this example the ssl module is not enabled, so the SSLEngine directive generates an error when the configuration is tested. The last line also indicates that The Apache error log may have more information , which is the next place to look for more detailed debugging information.
Apache Log Files
Apache log files are a very helpful resource for troubleshooting. Generally, any error that you receive in a browser or other HTTP client will have a corresponding entry in Apache’s logs. Sometimes Apache will also output errors related to configuration, built-in modules, and other debugging information to its log files.
To examine log files for errors while troubleshooting Apache on a Fedora, CentOS, or RedHat server, examine the /var/log/httpd/error_log file.
If you are troubleshooting a Debian or Ubuntu derived system, examine /var/log/apache2/error.log for errors using a tool like tail or less . For example, to view the last two lines of the error log using tail , run the following command:
Substitute the number of lines that you would like to examine in place of the number 2 in the command. On a CentOS or Fedora system, the log file to examine is /var/log/httpd/error_log .
An example error will resemble something like the following lines, regardless of which Linux distribution you are using to run your Apache server:
The two lines in this output are distinct error messages. They both reference the module causing the error ( proxy in the first line, proxy_http in the second) and include an error code that is specific to the module. The first one, AH00957 , indicates that the Apache server attempted to connect to a backend server (127.0.0.1 on port 9090 in this case) using the proxy module but failed to do so.
The second error is derived from the first: AH01114 is a proxy_http module error that also indicates that Apache was unable to connect to the configured backend server to make an HTTP request.
These example lines are just for illustration purposes. If you are diagnosing errors with your Apache server, chances are the error lines in your logs will have different contents than these. Regardless of your Linux distribution, the format of any error lines in your logs will include the relevant Apache module and error code, as well as a text description of the error.
Once you have an idea of what might be causing problems with your Apache server you can continue researching and troubleshooting the issue. The error code and text description are especially useful, since they give you explicit and specific terms that you can use to narrow down the range of possible causes of a problem.
Conclusion
Troubleshooting Apache errors can range from diagnosing errors with the service itself, to locating misconfigured options for modules, or to examining customized access control rules in detail. This introduction to diagnosing issues with Apache explained how to use a number of utilities to help narrow down the possible causes of errors. Usually, you will use these utilities in the same order, although you can always skip some, or start directly with examining logs if you have a general idea of what the problem might be.
However, as a general sequence for troubleshooting, it helps to be methodical and use these tools in the order described. Start troubleshooting with systemctl to examine the state of the Apache server. If you need more information, examine the systemd logs for Apache using the journalctl command. If the issue is still not apparent after checking journalctl , testing Apache’s configuration using apachectl configtest is the next step. Finally, for in-depth troubleshooting, examining Apache’s log files will usually indicate a specific error, with helpful diagnostic messages and error codes.
The rest of the tutorials in this series will examine some common errors that you may encounter when using Apache in more detail.
Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.
Tutorial Series: Common Apache Errors
This tutorial series explains how to troubleshoot and fix some of the most common errors that you may encounter when using the Apache web server.
Each tutorial in this series includes descriptions of common Apache configuration, network, filesystem, or permission errors. The series begins with an overview of the commands and log files that you can use to troubleshoot Apache. Subsequent tutorials examine specific errors in detail.
Where are the Apache and PHP log files?
I’ve installed Apache, PHP, and MySQL on Ubuntu 10.10 desktop edition, and it’s working fine.
Except I have no clue where to look for Apache or PHP log files.
5 Answers 5
By default, /var/log/apache2/error.log .
This can be configured in /etc/php5/apache2/php.ini .
Check these settings in php.ini :
- error_reporting = E_ALL | E_STRICT (as recommended for development in php.ini)
- error_log = /var/log/php_errors.log
Then create log file manually
Now you can view PHP errors by this way
This is an agreeable solution to this issue for me.
You can also define a specific error log file for each VirtualHost in Apache. If you have any VirtualHost defined in /etc/apache2/sites-available/ and enabled in /etc/apache2/sites-enabled (enable with sudo a2ensite [your-virtualhost-definition-file] ), you can change the error log by adding the following line inside your VirtualHost config:
That might be useful if you have a lot of vhosts and want to split where they report the errors.
Also, you can watch your error log live by issuing the following command (adapt to your own log file if different from the default):
This is particularly useful when doing live debugging.
If Apache was setup with Webmin/Virtualmin there is a separate folder for each VirtualHost.
folder for each VirtualHost user.
These are two files:
To view log files for each particular domain login as VirtualHost owner user of that hostname and run