Server log file analysis for SEO: complete guide

# Nginx: view the last 1000 lines of the access log
tail -n 1000 /var/log/nginx/access.log

# Size of the current log file
du -sh /var/log/nginx/access.log

# Decompress and merge rotated logs
zcat /var/log/nginx/access.log.*.gz | cat - /var/log/nginx/access.log > all_access.log

# Line count (≈ number of requests) in the merged file
wc -l all_access.log

# Combined Log Format record (Nginx/Apache)
66.249.66.1 - - [19/May/2026:14:32:01 +0000] "GET /blog/seo-guide/ HTTP/1.1" 200 45231 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
│           │ │  │                              │                          │    │       │   │
│           │ │  │                              │                          │    │       │   └─ User-Agent
│           │ │  │                              │                          │    │       └───── Referer
│           │ │  │                              │                          │    └─────────── Bytes sent
│           │ │  │                              │                          └──────────────── HTTP status
│           │ │  │                              └─────────────────────────────────────────── Request
│           │ │  └────────────────────────────────────────────────────────────────────────── Timestamp
│           │ └───────────────────────────────────────────────────────────────────────────── Auth user
│           └─────────────────────────────────────────────────────────────────────────────── Ident
└─────────────────────────────────────────────────────────────────────────────────────────── IP address

# Extract all Googlebot requests
grep -i 'googlebot' /var/log/nginx/access.log > googlebot.log

# Extract all SEO crawlers
grep -iE '(googlebot|bingbot|yandex|ahrefsbot|semrushbot|mj12bot)' \
     /var/log/nginx/access.log > all_bots.log

# Count requests by crawler
grep -oiE '(googlebot|bingbot|yandexbot|ahrefsbot|semrushbot)' \
     /var/log/nginx/access.log | sort | uniq -c | sort -rn

# Verify IP via reverse DNS (confirm it's the real Googlebot)
host 66.249.66.1
# Should return: crawl-66-249-66-1.googlebot.com
# Then forward DNS:
host crawl-66-249-66-1.googlebot.com
# Should return the same IP — then it's a legitimate Googlebot

# Top 20 URLs Googlebot crawls most often
grep -i 'googlebot' access.log \
  | awk '{print $7}' \
  | sort | uniq -c | sort -rn | head -20

# Response status distribution for Googlebot
grep -i 'googlebot' access.log \
  | awk '{print $9}' \
  | sort | uniq -c | sort -rn

# URLs returning 404 to Googlebot
grep -i 'googlebot' access.log \
  | awk '$9 == 404 {print $7}' \
  | sort | uniq -c | sort -rn | head -50

# Googlebot request count by day
grep -i 'googlebot' access.log \
  | awk '{print $4}' \
  | cut -d: -f1 | tr -d '[' \
  | sort | uniq -c

# Parametric URLs in Googlebot requests
grep -i 'googlebot' access.log \
  | awk '{print $7}' \
  | grep '?' \
  | sort | uniq -c | sort -rn | head -30

import re
from collections import Counter

LOG_PATTERN = re.compile(
    r'(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] '
    r'"(?P<method>\S+) (?P<url>\S+) \S+" '
    r'(?P<status>\d{3}) (?P<size>\S+) '
    r'"(?P<referer>[^"]*)" "(?P<ua>[^"]*)')

def parse_log(path: str, bot_pattern: str = 'googlebot') -> list[dict]:
    entries = []
    with open(path) as f:
        for line in f:
            m = LOG_PATTERN.match(line)
            if not m:
                continue
            if bot_pattern.lower() not in m.group('ua').lower():
                continue
            entries.append({
                'ip': m.group('ip'),
                'url': m.group('url'),
                'status': int(m.group('status')),
                'ua': m.group('ua'),
            })
    return entries

entries = parse_log('access.log')

# Top 20 URLs by crawl frequency
url_counts = Counter(e['url'] for e in entries)
for url, count in url_counts.most_common(20):
    print(f'{count:>6}  {url}')

# 404 errors
errors = [e['url'] for e in entries if e['status'] == 404]
for url, count in Counter(errors).most_common(20):
    print(f'{count:>6}  404  {url}')

# Detect redirect chains in logs
# Step 1: extract all URLs with 301/302 status for Googlebot
grep -i 'googlebot' access.log \
  | awk '$9 ~ /^30[12]$/ {print $7}' | sort -u > redirects.txt

# Step 2: check if any of those URLs are also redirect sources
while read url; do
  if grep -q "GET $url " redirects.txt 2>/dev/null; then
    echo "CHAIN: $url"
  fi
done < redirects.txt

# Find 5xx errors grouped by URL and hour
grep -i 'googlebot' access.log \
  | awk '$9 ~ /^5/ {print $4" "$7}' \
  | cut -d: -f1-2 \
  | sort | uniq -c | sort -rn | head -20