Complete Guide to Server Log Analysis for Hosting & VPS

Server logs are permanent records of all activities on your hosting server. From HTTP requests by visitors, to PHP errors, to potential security threats — everything is logged. When you host a website on shared hosting or VPS, understanding how to read and analyze these logs is essential for debugging errors, monitoring performance, detecting hacking attempts, and ensuring your site runs smoothly. In this complete guide, we'll teach you everything you need to know about server log analysis.

What Are Log Files? What Does Hosting Log?

Log files are text files that record events happening on your server, each entry timestamped for precision. Every hosting provider and VPS keeps multiple types of logs:

• Access Log (Apache/Nginx) — Records every HTTP request to your website, including GET, POST, DELETE and other methods
• Error Log (Apache/Nginx) — Records errors generated by the web server itself, such as 404 Not Found, 500 Server Error, permission issues
• PHP Error Log — Records PHP-specific errors: syntax errors, undefined functions, undefined variables, fatal errors from your application code
• Mail Log — Records emails sent through the server, bounce messages, SMTP errors
• FTP Log — Records FTP connections and file transfer activities
• Control Panel Log — Records login activities and configuration changes in cPanel/DirectAdmin

By learning to read logs, you can diagnose problems instantly instead of guessing. When your website goes down, the error log often contains the exact answer. This is why experienced developers check logs first.

Log File Locations on Linux Server & SSH Access

If your hosting provider offers a graphical file manager (cPanel or DirectAdmin), you can download logs easily. But if you need SSH access to logs, you'll need to know their standard locations on Linux:

# Apache Access Log
/var/log/apache2/access.log
/var/log/httpd/access_log

# Apache Error Log
/var/log/apache2/error.log
/var/log/httpd/error_log

# Nginx Access Log
/var/log/nginx/access.log

# Nginx Error Log
/var/log/nginx/error.log

# PHP Error Log (varies by configuration)
/var/log/php-errors.log
/var/log/php.log
/home/username/public_html/error_log

# Mail Log
/var/log/maillog
/var/log/mail.log

Once you SSH into your server, you can read logs using standard Unix commands:

# View entire log file
cat /var/log/apache2/access.log

# View last 20 lines (most recent)
tail -20 /var/log/apache2/access.log

# View first 20 lines
head -20 /var/log/apache2/access.log

# View log page by page (press space to scroll)
less /var/log/apache2/access.log

Alternatively, download the log file via your hosting's file manager and view it on your local machine, which is often more convenient for analysis.

Apache/Nginx Access Logs & Combined Log Format

Access logs record every HTTP request to your website. They follow a standard format called "Combined Log Format":

203.0.113.5 - - [29/Jun/2026:10:23:14 +0700] "GET /index.php HTTP/1.1" 200 2326 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Each part of this log entry means:

• 203.0.113.5 — Visitor's IP address
• - — RFC 1413 Identity (unused)
• - — Authenticated User (- if not authenticated)
• [29/Jun/2026:10:23:14 +0700] — Timestamp of request
• "GET /index.php HTTP/1.1" — Request line (method, path, HTTP version)
• 200 — HTTP status code (200=success, 404=not found, 500=server error)
• 2326 — Response body size in bytes
• "-" — Referrer (which page linked to yours)
• "Mozilla/5.0..." — User Agent (browser information)

From this information, you can see where visitors come from, what browser they use, which pages they access, and whether requests succeeded or failed. Many 404s might indicate broken links; many 500s indicate a server-side error in your application.

PHP Error Log: Finding Errors That Cause Website Crashes

When your PHP-based website encounters an error — syntax error, undefined function, undefined variable — that information goes into the PHP error log. This file is typically configured in php.ini and varies by hosting provider:

/var/log/php-errors.log
/var/log/php.log
/home/username/public_html/error_log

Example PHP error log entries:

[29-Jun-2026 10:25:31 Asia/Bangkok] PHP Fatal error: Call to undefined function mysql_connect() in /home/user/public_html/db.php on line 15

[29-Jun-2026 10:26:45 Asia/Bangkok] PHP Warning: Undefined variable: $username in /home/user/public_html/login.php on line 42

[29-Jun-2026 10:27:12 Asia/Bangkok] PHP Parse error: syntax error, unexpected '}' in /home/user/public_html/config.php on line 23

Each error entry shows the exact file, line number, and error type. This makes it easy for developers to fix problems instantly. Even warnings should be addressed, as they often lead to larger failures later.

Using Grep & Awk to Analyze Logs on Command Line

When log files grow to millions of lines, manual reading becomes impractical. Use shell commands to extract exactly what you need. The most useful commands are grep (filter), awk (parse), sort, and uniq:

# Count 404 errors
grep " 404 " /var/log/apache2/access.log | wc -l

# Count 500 errors
grep " 500 " /var/log/apache2/access.log | wc -l

# Top 20 IPs by request count
awk '{print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -20

# Top URLs causing 404 errors
grep " 404 " /var/log/apache2/access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -10

# Browser distribution of visitors
awk -F'"' '{print $6}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -10

# Count requests on a specific date
grep "29/Jun/2026" /var/log/apache2/access.log | wc -l

# Find all errors from a specific IP
grep "203.0.113.5" /var/log/apache2/access.log | grep " 404 "

The awk command is powerful for parsing structured log data. By specifying fields (columns), you can extract exactly what you need. For example, awk '{print $1}' prints only the first field (IP address) of each access log line.

AWStats & GoAccess: Free Log Analysis Tools

For analyzing very large logs, two free tools stand out: AWStats and GoAccess.

AWStats is an older but still popular log analysis tool. Most hosting with cPanel includes it. AWStats analyzes your access log and generates an HTML report showing:

• Unique visitors per month/day
• Page views per URL
• Browser distribution
• Operating system distribution
• Traffic sources (referrers)

GoAccess is a newer tool with real-time capabilities and better flexibility. If you have VPS control, you can install and use GoAccess:

# Install GoAccess
sudo apt-get install goaccess

# Analyze an access log
goaccess /var/log/apache2/access.log -a

# Generate HTML report
goaccess /var/log/apache2/access.log -a -o html > report.html

GoAccess displays a real-time dashboard showing hits, visitors, bandwidth, top pages, top IPs, browser distribution, and more. This visual representation makes it easy to understand your traffic at a glance.

Large Log Files: What To Do When They Grow Too Big

Log files grow quickly. A high-traffic website's access log can grow hundreds of MB per day, consuming valuable disk space. Three approaches help manage this:

1. Logrotate — Linux automatically rotates logs using logrotate, which archives old logs and keeps only recent ones. Example configuration:

/var/log/apache2/*.log {
  daily
  missingok
  rotate 14
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
  sharedscripts
  postrotate
    if [ -f "var/run/apache2.pid" ]; then
      /etc/init.d/apache2 reload > /dev/null
    fi
  endscript
}

2. Truncate Logs — If disk space is critical, you can clear log contents to free up space immediately:

# Truncate Apache access log
> /var/log/apache2/access.log

# Truncate PHP error log
> /var/log/php-errors.log

3. Delete Old Logs — Remove logs older than a certain number of days:

# Delete logs older than 30 days
find /var/log -name "*.log" -mtime +30 -delete

Many hosting providers manage log rotation automatically, but if disk space becomes an issue, contact support — they can often extend log retention or set up custom rotation policies.

Detecting Hacking Attempts from Access Logs

Beyond troubleshooting, access logs reveal security threats. Watch for patterns like:

• 404 Storms — Single IP making 100+ 404 requests per minute likely indicates vulnerability scanning
• SQL Injection Patterns — Look for URLs containing ' OR '1'='1, UNION SELECT, DROP TABLE
• Path Traversal — URLs containing ../ or ..\ attempting to escape the web root
• Brute Force Login Attempts — Repeated requests to /wp-admin, /admin, /administrator

# Top IPs by request count (may reveal bot activity)
awk '{print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -10

# IPs generating most 404 errors (vulnerability scanning)
grep " 404 " /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

# Search for SQL injection patterns
grep -E "union|select|where|and|or|drop|insert|update|delete" /var/log/apache2/access.log

# Find path traversal attempts
grep "\.\.\/" /var/log/apache2/access.log

If you identify suspicious IPs, block them using firewall rules (.htaccess, iptables, or WAF) to prevent further attacks. Install a security plugin or WAF for additional protection.

Real-time Log Monitoring with Tail -f

To watch logs as events happen (live), use the tail -f command:

# Monitor access log in real-time
tail -f /var/log/apache2/access.log

# Monitor PHP error log in real-time
tail -f /var/log/php-errors.log

# Monitor web server error log in real-time
tail -f /var/log/apache2/error.log

This command streams new log entries as they're written, allowing real-time debugging. Press Ctrl+C to stop.

Combine tail -f with grep to monitor only events you care about:

# Monitor only 404 and 500 errors
tail -f /var/log/apache2/access.log | grep -E " (404|500) "

# Monitor requests from a specific IP
tail -f /var/log/apache2/access.log | grep "203.0.113.5"