2.4.1.20. Site access logs (Access log)

Downloaded logs can be analyzed by console commands or specialized tools like GoAccess or Apache Log Viewer.

Site access logs (Access logs) are logs of absolutely all requests to the site that reached our web server. They are located in the "Site access logs" section.

View log in real time

To enable, at the top of the page, click the green button "Show logs in real time" — once clicked, a block with real-time log display will appear:

The "Auto scroll" button enables or disables automatic downward scrolling of the log when new entries appear.

Reloading the page disables the real-time log display.

Traffic filtering

When using our protection service, it is displayed as "Protection".

When using traffic filtering services, such as Cloudflare or Deflect, it is not always possible to quickly track whether filtering is enabled or disabled, so the log may contain addresses of filtering services rather than real IP addresses of visitors. To forcibly update information about the filtering service in our system, click the button with the name of the filtering service you are using against "Automatically detected traffic filtering service":

After the button is pressed, new requests will be logged with real IP addresses. The old log entries will remain unchanged.

Date and filters

Important points:

  • Logs are stored only for the current and 3 previous months, and only for those days when there were requests to the sites. Older logs are not stored.
  • The current date in the calendar is always available, regardless of whether there are entries on that day.
  • If there is no log for yesterday in the calendar, it means that logs for that day are still being processed and will be available later (usually closer to the afternoon).

Calendar. Allows you to select the day for which the log will be displayed. In the calendar:

  • Light green — days for which logs are available.
  • Dark green — selected day.
  • Red frame — current date.

Time filter. Allows you to view the log not for the whole day, but for a selected time period.

Search. Allows you to filter requests by HTTP method, response code and presence of certain text in them.

Download. Download buttons:

  • "Download for day" — downloads the log for the day selected in the calendar.
  • "Download for month" — downloads the log for the month to which the selected day in the calendar belongs. ⚠️ The log for the current month includes all days from the beginning of the month, except the current one.

Deleting. Button to delete log for a certain day or month. ⚠️ The log is deleted irretrievably, we recommend downloading it to yourself before deleting it.

Log

Important points:

  • Requests from direct IP addresses of the hosting account are displayed in green.
  • When bot protection is enabled, related GET and POST requests will be present in the log.
  • A User-Agent of the form PHP (www.example.com), hosted by www.ukraine.com.ua means that the request was sent from our hosting from the site specified in the header using PHP (e.g. with the file_get_contents function).
  • When the site is working via Cloudflare:
    • The log does not include requests for which error 429 is returned.
    • Presence of IP addresses from the subnet 240.0.0.0/4 — this is the result of the Pseudo IPv4 option enabled in Cloudflare, which changes visitors' IPv6 addresses to IPv4 from a reserved range. These addresses cannot be fully interacted with. We recommend disabling the Pseudo IPv4 option and adding AAAA records with the main IPv6 address of your hosting account for the domain.
  • Service requests may occur in the logs:
  • HTTP protocol versions are not displayed. To view them, download the log and use third-party tools.

  • "Time" — request time.
  • "IP" — IP address from which the request was made, with a flag and country name. Addresses with restricted access are displayed in red. Clicking on the funnel substitutes the IP address into the filter.
  • "HTTP" — server response code to the request.
  • "Request":
    • GET / — request method and URI.
    • "Mozilla/5.0 (XXXXXX) XXXXXX — User-Agent of the visitor.
    • "https://www.google.com/" — URL source of the request (if present in the request).
  • "Size of response" — response size in bytes.
  • 🚫 — adds the IP address to the blacklist.
Content
    (6)