What is a web-server access log?¶

A web-server access log records requests received by a website or web application server.

It is the server’s account of requests that reached it, not a complete record of everything that happened on the user’s device.

Avoid this assumption: That an access-log entry proves a person deliberately viewed the page or carried out the action described by the URL. It may not.

A web-server log commonly records the source IP address, timestamp, request method, requested path, response status, data size, referring page and user-agent string. It can help establish that a request reached the server and how the server responded.

But a request can be generated by a browser, mobile app, script, search-engine crawler, security scanner, monitoring system, prefetch process or attacker. A response code may show that the server accepted or rejected the request, but it does not necessarily prove that the user saw the content or that a wider transaction completed.

Source addresses may belong to proxies, VPNs, content-delivery networks or shared networks. Where a reverse proxy or load balancer sits in front of the server, the visible address may be that intermediary unless forwarded-address fields are correctly recorded.

Investigators should identify the exact server or service that generated the log and whether any proxy or content-delivery layer altered the fields. Ask for the log format, field definitions, time zone, server configuration and relevant application records.

Preserve surrounding entries and any linked session, request or correlation identifiers. Correlate important requests with authentication, application, database, proxy and endpoint evidence. Where a URL appears to represent an action, confirm whether the application actually completed that action.

Operational takeaway¶

A web-server access log shows that a request reached a web service and received a recorded response, but it does not automatically prove human intent, content viewing, completed action or identity.