Skip to content
ToolMug

Access Log Analyzer

Drop your server's access.log here to see within seconds which pages are popular, which URLs return 404 and which IPs hit you hardest. The crawler section shows what SEO work needs most — whether Googlebot came, what it crawled and how many 404s it found.

Runs in your browser — nothing you enter is uploaded

or drop access.log / .gz files here

Paste log lines

Logs are read in your browser and never uploaded. Large files are processed in chunks.

How to use

  1. Choose the log format. The default combined format fits Nginx and Apache defaults; for a custom format, paste your log_format line from nginx.conf.
  2. Choose or drop one or more log files (.gz works too), or paste a few lines.
  3. Read the crawler stats, hourly requests, status codes, top URLs, 404 URLs, IPs, referrers and user agents.

Options explained

Crawler detection
Googlebot, Bingbot, Baiduspider, YandexBot, Applebot and other search crawlers, plus AI crawlers such as GPTBot and ClaudeBot, are recognised by user agent. Open a crawler to see the URLs it fetched most.
Real visitor IP
When the format includes $http_x_forwarded_for, its first address is used as the visitor IP — useful behind a CDN or reverse proxy.
File size
Files are read in chunks in your browser, so logs of hundreds of MB work; speed depends on your computer.

How a line becomes a record

Each line is matched against the log format and split into fields. This Googlebot request in the default combined format:

66.249.66.1 - - [10/Oct/2026:13:55:36 +0800] "GET /blog/post-1 HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

is read as IP 66.249.66.1, method GET, path /blog/post-1, status 404, 153 bytes, no referrer. The time is converted using its offset (+0800) to an exact moment, 05:55:36 UTC, so lines from servers in different time zones line up in the hourly chart, and the user agent is recognised as Googlebot, so the line adds one hit and one 404 to that crawler.

Behind a CDN, add "$http_x_forwarded_for" to the end of the format. A line ending in "203.0.113.7, 10.0.0.2" is then counted for 203.0.113.7, the first address, and not for the proxy.

Frequently asked questions

Are my logs uploaded?

No. Files are read and counted only in your browser and are gone when you close the page.

Is every Googlebot in the log really Google?

No — user agents are easy to fake. Paste suspicious IPs into the crawler IP verifier to confirm them by reverse DNS.

Why do many lines not match?

The log uses a different format. Hosting panels often change log_format; copy the one your nginx.conf actually uses into Custom log_format.

Privacy

This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.

Related tools