Server Log Analysis: How to Read Logs
access.log, error.log, syslog — each log tells a story. We explain how to read and analyze server logs to discover issues.
Why Server Log Analysis Matters
Server logs are the black box of your application. Every request, every error, every intrusion attempt, every operation — all recorded. The problem: most developers only read logs after something breaks. If you learn to read logs regularly, you catch problems before they become crises.
This guide explains the main log types, how to read them, and how to extract valuable information from them.
Main Log Types
| Log Type | Default Path | Content |
|---|---|---|
| System log | /var/log/syslog or /var/log/messages | System and service events |
| Authentication log | /var/log/auth.log | Login attempts (SSH, sudo) |
| Nginx Access | /var/log/nginx/access.log | Every incoming HTTP request |
| Nginx Error | /var/log/nginx/error.log | Web server errors |
| MySQL | /var/log/mysql/error.log | Database errors |
| Application log | storage/logs/ (Laravel) | Application errors and exceptions |
Reading the Access Log
Each line in an access log contains valuable information. Here is an example Nginx access log entry:
192.168.1.1 - - [25/Mar/2026:10:15:30 +0300] "GET /api/users HTTP/1.1" 200 1534 "https://example.com" "Mozilla/5.0..."
- 192.168.1.1: Visitor IP address
- [25/Mar/2026:10:15:30]: Date and time
- "GET /api/users HTTP/1.1": Request method and path
- 200: Response code (200 = success)
- 1534: Response size in bytes
- Mozilla/5.0...: Browser information
Important Response Codes
| Code | Meaning | Action |
|---|---|---|
| 200 | Success | None |
| 301/302 | Redirect | Verify it is intentional |
| 403 | Forbidden | Check permissions |
| 404 | Not Found | Fix broken links |
| 500 | Internal Server Error | Check error log immediately |
| 502 | Bad Gateway | Backend application not responding |
| 503 | Service Unavailable | Server is overloaded |
Essential Analysis Commands
Top 10 Most Visited Pages
Use this command to extract the most visited pages from an Nginx access log:
awk '{print $7}' access.log | sort | uniq -c | sort -rn | head -10
Top 10 IP Addresses
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10
Count of 500 Errors in the Last Hour
awk '$9 == 500' access.log | wc -l
Failed SSH Login Attempts
grep "Failed password" /var/log/auth.log | tail -20
Advanced Analysis Tools
GoAccess
A terminal-based log analyzer with an optional web interface:
- Real-time log file analysis
- Interactive terminal dashboard
- Shareable HTML reports
- Very lightweight — processes millions of lines in seconds
ELK Stack (Elasticsearch + Logstash + Kibana)
The most powerful solution for large-scale log analysis:
- Logstash: Collects logs from multiple sources and processes them
- Elasticsearch: Stores and indexes logs for fast searching
- Kibana: Visual interface for searching and creating dashboards
- Note: Requires significant RAM (8GB minimum for the full stack)
Loki + Grafana
A lightweight alternative to ELK from Grafana Labs:
- Does not index content — indexes metadata only (much cheaper)
- Integrates with your existing Grafana installation
- Well-suited for Kubernetes and container environments
What to Monitor in Logs Daily
- 500 errors: Any sudden increase means a problem in code or the database
- Recurring 404 errors: Broken links harm user experience and SEO
- Failed login attempts: Potential sign of a brute-force attack
- Slow queries: MySQL Slow Query Log reveals queries that need optimization
- Log volume: Logs growing at an abnormal rate indicate a problem
Log Management (Log Rotation)
Logs accumulate and fill the disk if not managed. The logrotate tool handles this automatically:
- Compress old logs (gzip)
- Delete logs after a defined period (e.g., 30 days)
- Daily or weekly rotation based on size
- Ensure logrotate is configured for every service: Nginx, MySQL, application
Security Tips
- Do not expose logs publicly (verify file permissions)
- Send log copies to an external server (if compromised, local logs may be deleted)
- Set up automated monitoring for specific patterns (e.g., more than 100 failed SSH attempts in an hour)
Log Analysis on CLOUD
CLOUD (cloud.net.sa) servers give you full root access to install and configure any log analysis system you need. Whether the simple GoAccess or the full ELK Stack, the infrastructure is ready for you. The CLOUD team helps your developer set up the appropriate logging system through free technical guidance sessions.
Learning to read logs is a fundamental skill for every developer and server administrator. Start with simple commands (grep, awk, tail), then progress to advanced tools as your environment grows. The key: read your logs every day, even if only for 5 minutes. You will discover things you never knew about.
--- ### Get Started Want to try it yourself? Choose the right hosting plan or build your custom server with the specs you need.