Where Are the Apache Error and Access Logs Located?

On Debian and Ubuntu, Apache writes its logs to /var/log/apache2/ (the error and access logs); on RHEL-family systems they live in /var/log/httpd/. This DevAnswers reference gives the default paths for each distro, how to find the exact path your server actually uses, and how to read and rotate them once you have them.

Default Apache Log Locations #

If nobody has changed the configuration, these are the defaults:

Note the RHEL-family names: error_log and access_log, with an underscore and no .log extension. The error log holds Apache’s diagnostic output and is the first place to look when something breaks; the access log records every request the server handles.

The split is just packaging convention: Debian and Ubuntu ship the server as apache2 and keep everything under /etc/apache2 and /var/log/apache2, while the RHEL family ships it as httpd, hence /etc/httpd and /var/log/httpd. It is the same Apache HTTP Server underneath.

Find Your Actual Log Path #

The paths above are defaults. Your server’s real paths are whatever the ErrorLog (error log) and CustomLog (access log) directives are set to. To find them, search the active configuration:

sudo grep -R -E 'ErrorLog|CustomLog' /etc/apache2/   # Debian / Ubuntu
sudo grep -R -E 'ErrorLog|CustomLog' /etc/httpd/      # RHEL-family

A typical result points you straight at the directive and its path:

/etc/apache2/apache2.conf:ErrorLog ${APACHE_LOG_DIR}/error.log
/etc/apache2/sites-enabled/000-default.conf:    CustomLog ${APACHE_LOG_DIR}/access.log combined

On Debian and Ubuntu the default config writes through the APACHE_LOG_DIR variable, which is set to /var/log/apache2/ in /etc/apache2/envvars. That is why the shipped vhost files reference ${APACHE_LOG_DIR} rather than a hard-coded path.

Per-Site Logs in a VirtualHost #

If you host more than one site, each can have its own logs. An ErrorLog or CustomLog inside a <VirtualHost> block overrides the server-wide default, so that site’s entries go to its own file:

<VirtualHost *:80>
    ServerName devanswers.test
    ErrorLog ${APACHE_LOG_DIR}/devanswers.test-error.log
    CustomLog ${APACHE_LOG_DIR}/devanswers.test-access.log combined
</VirtualHost>

So if a site’s requests are missing from the default access.log, check its virtual host file: they are probably going to a per-site log instead. The ${APACHE_LOG_DIR} variable above is Debian/Ubuntu-specific; on RHEL-family systems, point ErrorLog and CustomLog at explicit paths under /var/log/httpd/ instead.

Reading the Logs #

Logs are owned by root (the adm group on Ubuntu), so you need sudo. These examples use the Debian/Ubuntu paths; on RHEL-family systems swap /var/log/apache2/ for /var/log/httpd/ (or use whatever path your ErrorLog/CustomLog reported). Watch new entries as they happen, or search the history:

sudo tail -f /var/log/apache2/error.log       # watch the error log live
sudo tail -n 50 /var/log/apache2/access.log    # the last 50 requests
sudo grep ' 404 ' /var/log/apache2/access.log  # find 404s

Logs do not grow forever: logrotate rotates them on a schedule, moving older entries into numbered, gzipped files such as error.log.1 and access.log.2.gz in the same directory. If today’s log looks unexpectedly short, the older history is in those rotated files. When the error log points at a configuration problem rather than a crash, our guide on why Apache ignores .htaccess rules covers one of the most common ones. If the logs show a certificate issue, you can fix the SSLCertificateFile error by checking your file paths and permissions.

Summary #

Apache logs default to /var/log/apache2/ on Debian and Ubuntu and /var/log/httpd/ on RHEL-family systems. The real paths are whatever ErrorLog and CustomLog point to, so grep your config to confirm, and check a site’s <VirtualHost> block if its logs are not in the default file.