How to Read & Analyze Server Logs: A Practical Guide
Your server writes a detailed diary of every request it handles. Learning to read it turns "the site feels slow" into "that one IP is hammering /wp-login.php" — in about two minutes.
Anatomy of an Access Log Line
203.0.113.5 - - [02/Aug/2026:10:15:22 +0000] "GET /index.html HTTP/1.1" 200 5120 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
| Field | Example | What it tells you |
|---|---|---|
203.0.113.5 | 203.0.113.5 | The client's IP address |
[timestamp] | 02/Aug/2026:10:15:22 +0000 | When the request arrived (UTC offset shown) |
"request" | GET /index.html HTTP/1.1 | Method, path, and protocol |
status | 200 | Outcome: 2xx/3xx good, 4xx client, 5xx server |
bytes | 5120 | Response size in bytes |
"referer" | - | Where the visitor came from |
"user agent" | Mozilla/5.0 … | Browser or script that made the request |
What the Patterns Mean
| Pattern | Signal | Action |
|---|---|---|
One IP, many 404s on /wp-login.php, /.env | Scanner probing for weak spots | Rate-limit or block the IP; confirm no exposure |
| Rising 5xx rate | Application or server failure | Check app logs, upstreams, and disk immediately |
| Burst of 401s then 200s from one IP | Credential stuffing attempt | Enable rate limiting and lockout policies |
| Traffic spike on one path | Content going viral — or a hotlink | Check referers; add caching if legit |
python-requests / curl user agents at scale | Scripted traffic | Decide whether it's welcome (APIs) or abusive (scraping) |
The key skill is comparison, not inspection: a single 404 is nothing; 200 404s from the same IP in a minute is an event. The status-code distribution and top-IPs views exist to make those comparisons instant.
Understanding Error Rates
- 4xx (client errors): 404, 403, 401. Mostly noise from bad links and scanners — but a concentrated burst from one IP is a probe.
- 5xx (server errors): 500, 502, 503. Always worth attention — they mean your stack failed a request. A 5xx rate that climbs is an incident.
- Error rate formula: (4xx + 5xx) ÷ total requests. Healthy sites sit well under 5%; anything sustained above 10% has a story to tell.
Why Analysis Should Stay on Your Machine
- Upload-based analyzers receive your full logs — every client IP and internal hostname — and store them on their servers.
- Logs are sensitive: IPs can identify users, and routing data reveals your infrastructure layout.
- A browser analyzer parses everything locally: no upload, no account, no install, works offline — and the file never leaves your device.
For a quick triage, a local log analyzer gives you status codes, top IPs, top paths, and error rates in seconds. For centralized, multi-server, long-term analysis, ELK or Graylog remain the right tools — but they're infrastructure, not a quick answer.
Frequently Asked Questions
What is an access log?
An access log records every request your web server handled: the client IP, timestamp, HTTP method, requested path, response status code, bytes sent, referer, and user agent. Nginx and Apache write these by default, and they are the first place to look when diagnosing traffic, errors, or suspicious activity.
How do I find my server's access log?
Nginx defaults to /var/log/nginx/access.log; Apache uses /var/log/apache2/access.log on Debian/Ubuntu and /var/log/httpd/access_log on RHEL/CentOS. For a quick window, run tail -n 5000 /var/log/nginx/access.log and paste the output into a log analyzer. Syslog lives at /var/log/syslog on Debian/Ubuntu systems.
What does each field in an access log mean?
In the nginx combined format, each line is: client IP, two identity fields (usually dashes), a timestamp in brackets, the request line (method, path, HTTP version), the three-digit status code, bytes sent, the referer, and the user agent. The status code is the key signal: 2xx success, 3xx redirect, 4xx client error, 5xx server error.
How can I tell if my server is being scanned?
Look for the pattern: one IP generating many 404s against well-known paths like /wp-admin, /wp-login.php, /xmlrpc.php, or /.env; requests from python-requests, curl, or other scripted user agents; or a burst of 401/403 responses. A log analyzer's top-IPs and status-code views make this pattern visible in seconds.
What's the difference between 4xx and 5xx errors?
4xx errors are client problems — 404 Not Found, 403 Forbidden, 401 Unauthorized — usually caused by bad links, scanners, or permission issues. 5xx errors are server problems — 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable — indicating your application or infrastructure needs attention. A rising 5xx rate is an incident; a burst of 4xx is often just noise (or a scan).
Is it safe to paste logs into an online analyzer?
Only if it runs locally. Logs contain client IP addresses, internal hostnames, and routing data — uploading them to a SaaS analyzer hands that data to a third party. A browser-local analyzer parses everything on your device and never transmits anything. That's the entire point of the Prescosoft Log File Analyzer.
Triage your logs — privately
Status codes, top IPs, error rates — in seconds, with zero install and zero uploads. Your logs never leave your device.