Raw access log

Raw Access lets you download a domain's available web logs from cPanel. They contain request details such as the date, source address, path, method, HTTP code and, depending on the format, browser or referrer.

Download the right log

1. Log in to cPanel and look for Raw Access.
2. Select the domain and the HTTP or HTTPS variant you want to investigate.
3. Download the file and unzip it into a private directory on your computer.
4. Check the first and last dates in the content and their time zone.

Logs are rotated. If an old request does not appear, it may be because of the period kept, not because it never happened. The Raw Access documentation explains the archive and retention options available.

Investigate an incident

Search for the known time and path, and check several lines from the same interval. Tell a request for the main document apart from its images, CSS, JavaScript or application calls. A single visitor can generate many requests.

Bots also appear, and browser identifiers can be faked. An IP does not necessarily identify a person: it may belong to a shared network or a proxy. With a CDN, part of the traffic may never reach the origin and the information depends on how the proxy is logged.

A 200 only shows the status of that response; an application can deliver an error page with that code. Combine the access logs with the error log and the application's data when you investigate a fault.

Retention and privacy

Archiving logs uses disk space and its scope depends on the service configuration. Check what you need to keep before enabling or disabling archive options.

Do not upload full logs to a public folder: paths and parameters may include personal data or tokens. When you ask for help, share the interval and the lines needed, removing secrets and data unrelated to the diagnosis.