How to Analyze PHP access logs

The PHP access log is useful for evaluating how your application handles requests, this is especially true when evaluating the performance of PHP. You will need to SSH into your server as the app's system user to run these commands.

In the examples shown, replace "X.Y" with your app's PHP version (for example, "8.4").

First: define a shell variable with the app's PHP access log file location

This variable must be set otherwise the remaining commands will not work. The variable will not persist across SSH sessions and must be set in any new sessions.

Replace SYSUSER with your apps system user and APPNAME with your application's name

LOGFILE=/srv/users/SYSUSER/log/APPNAME/APPNAME_phpX.Y.access.log

Verify the variable is set correctly.

echo "$LOGFILE"

The output should be similar to:

/srv/users/SYSUSER/log/APPNAME/APPNAME_phpX.Y.access.log

Print the number of requests per IP address for the 20 addresses that have made the most requests

cat "$LOGFILE" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n20

Print all requests from a specific IP address

For example, set REMOTE_ADDR to an address you saw in the output of the above command.

REMOTE_ADDR=1.2.3.4
grep -F "$REMOTE_ADDR" "$LOGFILE"

Count the total number of requests in the current log file

wc -l "$LOGFILE"

View the first request in the log

This is useful to see the date and time when the current log file began.

head -n1 "$LOGFILE"

View the last request in the log

This is useful to see the date and time of the most recent request.

tail -n1 "$LOGFILE"

Counting `redirect` and `file not found responses`

Checking the total number of 404 (not found) and 301/302 (redirect) responses in an app's PHP access log can be useful because large numbers of 404 or 301/302 requests indicate where additional .htaccess rules, for example, could be useful to decrease resource usage. That is, it's much more expensive in terms of resource usage to have your PHP application serve large numbers of 301/302/404 responses than to have Apache serve large numbers of 301/302/404 responses.

Count the number of 404 responses

grep -cF " 404 " "$LOGFILE"

Show up to 1000 of the most recent 404 responses

grep -F " 404 " "$LOGFILE" | tail -n1000

Count the number of 301 and 302 responses

grep -cF -e " 301 " -e " 302 " "$LOGFILE"

Show up to 1000 of the most recent 301 and 302 responses

grep -cF -e " 301 " -e " 302 " "$LOGFILE"

Last updated: December 16, 2024