Raw access logs in cPanel: analyze website traffic

Raw access logs record individual HTTP requests to your website. They are useful when summary statistics are not enough and you need exact IP addresses, requested URLs, status codes, referrers, and user agents.

Download raw logs

1. Log in to cPanel.
2. Open Metrics and choose Raw Access.
3. Click the log file for the domain you want to inspect.
4. Download the compressed .gz file.
5. Decompress it locally with your archive tool, or with gunzip on Linux/macOS.

Log format

203.0.113.10 - - [05/Jun/2026:12:34:56 +0000] "GET /page.html HTTP/1.1" 200 1234 "https://example.com/" "Mozilla/5.0"

# Typical fields:
# IP, timestamp, request method, URL, protocol, status code, bytes, referrer, user agent

When to use raw logs

• Find which URLs are returning 404, 403, 500, or 503 responses.
• Identify IP addresses making excessive requests.
• Confirm whether a bot, crawler, or external monitor is hitting the site.
• Review exact request times around an outage or abuse report.
• Compare origin traffic with Cloudflare or analytics reports.

Analyze locally

If you are comfortable with command-line tools, these examples can help after downloading and extracting the log:

# Top requested paths
awk '{print $7}' access_log | sort | uniq -c | sort -rn | head -10

# Count 404 responses
grep '" 404 ' access_log | wc -l

# Top source IP addresses
awk '{print $1}' access_log | sort | uniq -c | sort -rn | head -20

Archive settings

In Raw Access settings, you can choose whether cPanel archives logs in your home directory at the end of each month. Enable archiving only if you need historical logs, because stored logs count toward disk usage.

Related: Web and FTP statistics in cPanel: AWStats, Webalizer, and usage reports | Error logs in cPanel: find PHP and website errors | IP Blocker in cPanel: block abusive visitors safely | Disk and bandwidth usage in cPanel: find storage and traffic problems

Related articles