How to use the access log summarizer
- Paste lines from a web server access log in the common or combined log format, as written by Apache and nginx by default. One request per line.
- Choose how many rows to show in the top lists, from 1 to 50.
- Read the headline, the tables of status classes and codes, the busiest paths, the top clients and the requests by hour.
- Copy or print the summary, or download the paths table as a CSV.
Formula
Line pattern: client identity user [time] "request" status bytes ["referrer" "user agent"]
Path = the request target without the query string or fragment
Share = requests in a row / total requests
Error responses = status codes from 400 to 599
The hour is the hour written inside the time stamp of each line, in the time zone the server logged. A dash in the bytes field counts as 0 bytes.
Seven requests
The sample log has 7 lines from 3 clients: 203.0.113.7 with 3 requests, 198.51.100.4 with 2 and 192.0.2.55 with 2. The status codes are 200 three times, 302, 304, 404 and 500 once each, so 3 are 2xx, 2 are 3xx, 1 is 4xx and 1 is 5xx. The 2 error responses are 28.6% of all requests.
The path /index.html is the most requested with 3 hits, counting /index.html?ref=mail because the query string is removed. The requests fall in hour 13 (3), hour 14 (3) and hour 15 (1), and 10,412 bytes were sent, which is 10.17 KB.
What to look for
A summary of the log answers common questions quickly. Which pages get the most traffic? Which paths return errors? Is one client making a very large number of requests? When is the busiest hour? A rising share of 5xx responses points to a problem on the server, while many 404 responses for the same path point to a broken link.
The table of top paths includes an errors column, so you can see which pages fail most. The top clients table helps spot a script or a crawler that is making far more requests than anyone else. For general statistics on numbers in a CSV, use CSV Statistics, and for the meaning of port numbers see the Common Ports List.
Formats, limits and care
The tool reads the common log format and the combined format, which adds the referrer and the user agent. Lines in other formats, such as JSON logs or custom patterns, are counted as not matched and left out. Up to 200,000 lines are read at a time, so cut a larger log into pieces first.
Logs hold addresses of real visitors. This tool works in your browser and does not upload or store the text, but be careful when you share the results and mask the addresses first. The Email Header Analyzer reads mail headers in the same way, and the Unix Timestamp Converter helps with logs that use epoch times.
Assumptions and limits
- Each line is one request in the common or combined log format, with the time in square brackets.
- Hours are the hours written in each line, so logs in different time zones are not converted.
- Counts are exact for the lines pasted. Bot traffic and cached responses are not separated.
- Nothing is uploaded or stored, and the result is a summary, not a security analysis.
Frequently asked questions
Which log formats are supported?
The common log format and the combined log format, which are the defaults in Apache and nginx. Each line has the client address, the time in brackets, the quoted request, the status and the size in bytes.
Why does the path ignore the query string?
Different query strings on the same page would otherwise show as many different paths. Removing everything after a question mark groups requests for the same page together.
What counts as an error?
Any response with a status from 400 to 599: client errors such as 404 and server errors such as 500. Redirects in the 300 range are not counted as errors.
Is my log uploaded?
No. The lines are read and counted in your browser. They are not sent to a server and are not kept after you close the page.