Access logs record every request the server received, including from visitors who blocked your analytics, crawlers, and anything that failed before a page loaded. They answer a specific set of questions that analytics cannot, and they are available in your hosting control panel without installing anything.

What a log entry contains

One line per request. Not per visitor, per request, which means a single page view produces a line for the page and one for each image, stylesheet, and script it loaded.

Each line records who asked, when, what they asked for, what the server answered with, how much was sent, where they came from, and what software they were using. That is more raw detail than analytics provides and considerably less interpretation.

The status code is the field that does most of the work. 200 means the request succeeded, 301 and 302 are redirects, 404 means not found, and 500 means the server failed while trying.

What logs tell you that analytics cannot

Requests that never ran your analytics

Analytics depends on a script executing. A visitor who left before the page finished, or who blocks tracking, never appears. The log records them regardless, which is why log traffic is always higher than analytics traffic.

What is actually returning 404

The log shows every failed request with the address that was asked for and, usually, the page that linked to it. That is how you find broken links, missing images, and old addresses people are still visiting.

Far more reliable than waiting for someone to report it, since almost nobody does.

Which crawlers are visiting, and how much

Search engine crawlers, AI crawlers, and a considerable amount of automated traffic that has nothing to do with anyone. On a small site this is frequently the majority of requests.

What happened during an outage

When a site was slow or unavailable, the log shows what was being requested and what the server returned. It is the record that turns a vague report into a specific cause.

Where to find them

Most hosting control panels have a raw access logs section, offering a download of the current log and archives of previous periods.

Two things worth knowing. Logs are usually rotated, meaning older ones are compressed or deleted after a period, so the window is limited unless archiving is enabled. And the error log is separate from the access log, recording failures rather than requests, which is where a 500 error's actual cause appears.

Some panels also offer a summarised report generated from the logs, which is easier to read and less precise. The raw log is where the specific answers are.

Reading one without tools

A log file is plain text and can be opened in anything, though a month of it on a modest site is large enough to be awkward.

The practical approach for a site owner is searching rather than reading. Search for 404 to find missing files. Search for 500 to find failures. Search for a specific address to see who requested it. That answers most questions without any analysis tool.

Where you are comfortable at a command line, sorting and counting turns the file into a summary in one line. Where you are not, the control panel's summarised report covers the common questions adequately.

What to actually look for

The probing question

Every site receives automated requests looking for known vulnerable paths. On a small business site this can be thousands of entries a month.

It is background noise rather than an attack, and the correct response is not alarm. It is to make sure the things being probed for do not exist or are protected, which means keeping software updated and not leaving old installations in subfolders.

The log is useful here mainly as confirmation that the probes are failing. Where they are succeeding, the log shows that too, and that is a different situation entirely.

Privacy and retention

Logs contain visitor addresses, which is personal information in several jurisdictions.

That has two practical implications. Do not publish or share raw logs casually. And if you enable archiving, know how long you are keeping them and why, since indefinite retention of personal data without a reason is the kind of thing your privacy policy should reflect.

For most small businesses the default rotation is fine and no decision is needed. It becomes a consideration only if archiving is switched on and forgotten.

When to look

Not routinely. Logs are a diagnostic rather than a report.

Worth opening when something is broken and the cause is not obvious, when a page seems to be missing from search, after a migration to catch addresses that did not carry over, and when the site has been slow without explanation. The rest of the time analytics answers the questions you actually have, and the log sits there until something needs explaining that analytics cannot see, in the same way the browser console covers the other half of the same problem.

Frequently asked questions

What are server access logs?

A record of every request the server received, one line per request. They include the address asked for, the status code returned, the size of the response, and where the visitor came from.

What do logs show that analytics does not?

Visitors who blocked or never ran your analytics script, every 404 and 500 error, crawler traffic, and what was happening during an outage. Log traffic is always higher than analytics traffic.

Where do I find my access logs?

In your hosting control panel, usually under raw access logs. The error log is separate and records failures rather than requests, which is where a 500 error's cause appears.

What should I look for in a log?

Repeated 404s on the same address, missing files your own pages request, any 500 errors, very large responses slowing pages, and unusual volume from one source.

Should I worry about automated probing in my logs?

It is background noise on every site. The correct response is keeping software updated and removing old installations, not alarm. The log confirms whether the probes are failing.

How often should I read my logs?

Not routinely. They are a diagnostic for when something is broken, a page is missing from search, or the site has been slow without explanation.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Something wrong and analytics showing nothing?

We read the access and error logs, which record what actually happened rather than what a tracking script managed to report.

Start a Conversation