Apache Log Files Explained: How to Read Access and Error Logs

Apache keeps two separate records: the access log writes one line for every request it serves, and the error log records what went wrong while serving them. The access log tells you what happened; the error log tells you why.

Most servers use the "combined" format: seven Common Log Format fields followed by the referrer and the user agent. Apache's default definition is shown first; Debian swaps %b for %O, which counts bytes including headers.

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

203.0.113.9 - - [14/Nov/2026:10:14:02 +0530] "GET /pricing/ HTTP/1.1" 200 18421 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Read as a sentence: a Windows visitor arriving from Google loaded /pricing/ at 10:14 IST and received 18,421 bytes with status 200.

A handful of tail, awk and grep one-liners answer most log questions in seconds on any VPS. In the combined format, field 1 is the IP, field 7 the path and field 9 the status. Swap the path for /var/log/httpd/access_log on RHEL-family systems.

# watch errors live while you reproduce a fault
sudo tail -f /var/log/apache2/error.log

# how many of each status code
awk '{print $9}' /var/log/apache2/access.log | sort | uniq -c | sort -rn

# top 20 paths returning 404
awk '$9 == 404 {print $7}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -20

# busiest client IPs
awk '{print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -20

# busiest user agents (bots stand out quickly)
awk -F'"' '{print $6}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -15

# search rotated, compressed logs too
zgrep ' 500 ' /var/log/apache2/access.log*

For a 500 error, take the time and IP from the access line and search the error log for the same second; the matching entry names the script. Repeated 403 lines usually mean a permission or .htaccess deny rule, explained in the 403 Forbidden fix guide. Thousands of POSTs to /wp-login.php or /xmlrpc.php from a few IPs are brute-force attempts worth blocking with Fail2ban.

Use cPanel's Metrics tools when you have no shell, and GoAccess when you have SSH and want a dashboard rather than raw lines.

• cPanel Metrics: Visitors (last 1,000 hits per domain), Errors, Raw Access download and AWStats, all included with WebJi® Linux hosting.
• GoAccess: goaccess /var/log/apache2/access.log --log-format=COMBINED -o report.html builds a single HTML report; add --real-time-html for a live view.
• Plain shell: the one-liners above, which work on any host with SSH and need nothing installed.

If you are weighing Apache against an event-driven server for a busy site, Apache vs Nginx compares how each handles load and logging.