How to analyze Apache access logs to evaluate access to your website - Simple Log Service

After Apache access logs are collected to Simple Log Service, you can create a dashboard to analyze data such as page views (PVs), unique visitors (UVs), IP address distribution, error requests, and client types. Then, you can evaluate access to your website.

Prerequisites

A Logtail configuration is created to collect Apache access logs. For more information about how to create a Logtail configuration, see Collect text logs from servers. If you follow the instructions in that topic to create a Logtail configuration, select Apache-Text Logs in Step 2.

Background information

Apache is a mainstream web server. If you use an Apache web server to build a website, you can use Apache logs to perform website O&M.

Simple Log Service provides a data import wizard that you can use to collect Apache access logs. Simple Log Service also creates indexes and a dashboard for the collected logs. The dashboard displays data in charts, such as Distribution of IP Addresses, HTTP Status Codes, Request Methods, PV and UV Statistics, Inbound and Outbound Traffic, User Agents, Top 10 Request URLs, Top 10 URIs by Number of Requests, and Top 10 URIs by Request Latency.

Procedure

Log on to the Simple Log Service console.
In the Projects section, click the project that you want to manage.
In the left-side navigation pane, choose Dashboard > Dashboards. In the Dashboard list, find and click the dashboard named ${Logstore name}_Apache access log.
The dashboard provides the following charts:
- Distribution of IP Addresses: displays the distribution of IP addresses. The following query statement is used for this chart:
```
* | select ip_to_province(remote_addr) as address, count(1) as c group by ip_to_province(remote_addr) limit 100
```
- HTTP Status Codes: displays the percentage of each HTTP status code returned within the previous day. The following query statement is used for this chart:
```
* | select status, count(1) as pv group by status
```
- Request Methods: displays the percentage of each request method used within the previous day. The following query statement is used for this chart:
```
* | select request_method, count(1) as pv group by request_method
```
- PV and UV Statistics: displays the numbers of PVs and UVs within the previous day. The following query statement is used for this chart:
```
* | select date_format(date_trunc('hour', __time__), '%m-%d %H:%i')  as time, count(1) as pv, approx_distinct(remote_addr) as uv group by date_format(date_trunc('hour', __time__), '%m-%d %H:%i') order by time limit 1000
```
- Inbound and Outbound Traffic: displays the inbound and outbound traffic. The following query statement is used for this chart:
```
* | select date_format(date_trunc('hour', __time__), '%m-%d %H:%i') as time, sum(bytes_sent) as net_out, sum(bytes_received) as net_in group by time order by time limit 10000
```
- User Agents: displays the percentage of each browser used within the previous day. The following query statement is used for this chart:
```
* | select case when http_user_agent like '%Chrome%' then 'Chrome' when http_user_agent like '%Firefox%' then 'Firefox' when http_user_agent like '%Safari%' then 'Safari' else 'unKnown' end as http_user_agent, count(1) as pv group by case when http_user_agent like '%Chrome%' then 'Chrome' when http_user_agent like '%Firefox%' then 'Firefox' when http_user_agent like '%Safari%' then 'Safari' else 'unKnown' end   order by pv desc limit 10
```
- Top 10 Request URLs: displays the pages from which the top 10 resources with the most PVs are requested within the previous day. The following query statement is used for this chart:
```
* | select  http_referer, count(1) as pv group by http_referer order by pv desc limit 10
```
- Top 10 URIs by Number of Requests: displays the top 10 request URIs with the most PVs within the previous day. The following query statement is used for this chart:
```
* | select split_part(request_uri,'?',1) as path,  count(1) as pv group by split_part(request_uri,'?',1) order by pv desc limit 10
```
- Top 10 URIs by Request Latency: displays the top 10 request URIs with the highest latency within the previous day. The following query statement is used for this chart:
```
* | select request_uri as top_latency_request_uri,
            request_time_sec 
            order by request_time_sec desc limit 10 10
```