Reading and understanding server log files

What are log files and why are they important?

Log files are the digital memory of your web server. They record every access, every error and every security-related event. For website operators, developers and administrators, they are an indispensable tool for fault analysis, security monitoring and performance optimisation.

Typical use cases for log file analysis:

• Troubleshooting: Why is my website showing a 500 error? Which script is causing the problem?
• Security analysis: Have there been any attempts to attack my website? Which IP addresses are trying to gain unauthorised access?
• Performance optimisation: Which pages are accessed most frequently? Are there any resources that take a particularly long time to load?
• Debugging: Identifying PHP errors, failed database connections or configuration issues
• Visitor analysis: Where do my visitors come from? Which bots are crawling my site?

Available log types

Your SpeedIT hosting service provides you with various types of log files, each of which records different information:

Location of the log files

Your log files are located in a dedicated directory on the server. The exact path is:

/home/users/YOUR-USERNAME/logs/your-domain.de/

The logs have been organised for greater clarity sorted by domain name. If you are running several domains on your hosting package, you will find a separate subfolder for each domain.

Structure of the log directories:

/home/users/YOUR-USERNAME/
└── logs/
    ├── your-domain.de/
    │   ├── access.log
    │   ├── error.log
    ├── second-domain.de/
    │   ├── access.log
    │   ├── error.log
    └── ...

Analysing log files - your options

There are several ways to access your log files:

Method 1: Using the KeyHelp File Manager

The easiest way to view it occasionally:

1. Log in to the web server
2. Go to General → File Manager
3. Navigate to the root directory using the arrow with the three dots, then click onlogs
4. Select the desired domain and open the log file

Tip: In the File Manager, you can view files directly, download them or open them using the built-in editor.

Method 2: Via FTP/SFTP

Ideal for downloading large log files for local analysis:

1. Connect to your server using an FTP client (e.g. FileZilla)
2. Navigate to the directory logs (directly in the home directory)
3. Select the domain and download the files you require

Recommended settings for SFTP:

Method 3: Via SSH (for advanced users)

The most powerful method for real-time analysis and filtering:

1. Connect to your server via SSH
2. Navigate to the log directory: cd ~/logs/your-domain.de/
3. Use Linux commands for analysis (see section below)

Analysing log files - Useful SSH commands

With SSH access, you can search through and filter logs efficiently. Here are the most important commands:

Basic commands

Search and filter logs

# Search for a specific term
grep "500" error.log

# Search for an IP address
grep "192.168.1.100" access.log

# Find errors from a specific date
grep "19/Dec/2025" error.log

# Find ModSecurity blocks
grep "ModSecurity" error.log

# Find PHP fatal errors
grep "Fatal error" error.log

# Display all 404 errors
grep '" 404 ' access.log

Advanced analyses

# Top 10 IP addresses by number of requests
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10

# Top 10 most visited URLs
awk '{print $7}' access.log | sort | uniq -c | sort -rn | head -10

# All 500 errors with timestamps
grep '" 500 ' access.log | awk '{print $1, $4, $7}'

# Count requests per hour
awk '{print $4}' access.log | cut -d: -f2 | sort | uniq -c

# Only errors from the last hour (approximately)
tail -1000 error.log | grep "$(date +%H:)"

Understanding Log Files - Structure and Interpretation

Access log format

A typical entry in the access log looks like this:

192.168.1.100 - - [19 Dec 2025 14:23:45 +0100] "GET /page.html HTTP/1.1" 200 4523 "https://google.de" "Mozilla/5.0..."

Important HTTP status codes

Understanding error log entries

Error logs contain more detailed information about problems:

[Fri 19 Dec 14:30:22.123456 2025] [php:error] [pid 12345] [client 192.168.1.100:54321] PHP Fatal error: Uncaught Error: Call to undefined function xyz() in /www/script.php:42

Log rotation and retention

To save storage space and keep things organised, log files are automatically rotated:

• Latest logs: access.log, error.log - contain the current entries
• Archived logs: access.log.1, access.log.2.gz etc. - older logs, some of which are compressed
• Retention period: Log files are usually retained for 4-8 weeks

Tip: If you need older logs, download them regularly and archive them locally.

Practical examples of use

Example 1: Debugging a 500 error

Your website is displaying a 500 error. Here’s what to do:

1. Open the error log: tail -100 error.log
2. Check for PHP errors: grep "Fatal error\ | "Parse error" error.log
3. Make a note of the file and line in question
4. Fix the error in the code

Example 2: Detecting attempted attacks

You suspect that your website is under attack:

1. Checking ModSecurity blocks: grep "ModSecurity" error.log
2. Identifying suspicious IP addresses: awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20
3. Analysing requests from a suspicious IP address: grep "SUSPECT-IP" access.log

Example 3: Resolving 404 errors for SEO

Broken links harm your SEO ranking:

1. List all 404 errors: grep '" 404 ' access.log | awk '{print $7}' | sort | uniq -c | sort -rn
2. Please check whether these URLs should exist
3. Set up redirects or correct the links

Related articles

• ModSecurity - Your shield against cyber attacks
• Server unavailable / IP block
• Fixing a 500 Internal Server Error
• 404 Not Found - Page not found

Do you need help?

If you need assistance with log analysis or are unable to resolve an error yourself, please contact our support team. Where possible, please provide the relevant log entries - this will significantly speed up the troubleshooting process.

Contact Support