Apache’s access and error logs contain a huge amount of diagnostic information — the challenge is usually finding the specific line that matters among thousands of routine entries.
# Find the most requested URLs
awk '{print $7}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -20
# Find all 500 errors
grep ' 500 ' /var/log/apache2/access.log
# Find requests from a specific IP
grep '^203\.0\.113\.' /var/log/apache2/access.log
# Real-time tail while reproducing an issue
tail -f /var/log/apache2/error.log
# Top requesting IPs (useful for spotting abuse/scraping)
awk '{print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -rn | head -10
Custom Log Formats
# Add response time in microseconds - genuinely useful for performance debugging
LogFormat "%h %l %u %t \"%r\" %>s %b %D" timing
CustomLog ${APACHE_LOG_DIR}/timing.log timing
Adding %D (response time) to your log format turns the access log into a lightweight performance monitoring tool — genuinely useful for spotting slow endpoints without setting up a separate APM tool.