How to view raw logs


I’m trying to view my site’s logs using this page in the Wiki:

I’m just now sure how to actually go through the logs and find causes of heavy usage. It says to enter different commands to find causes of heavy usage (IP addresses that are downloading the most, etc.), but where do I enter that command? Do I need a specific program? I downloaded my site’s logs via FTP, but I don’t know what to do from there. Can someone please help me out? I literally don’t know anything about going through my site’s logs, but I’ve been having issues with certain IP addresses bogging down my site. Thanks in advance.


It works best to log in here via SSH and enter the commands locally:

It’s not often that “abuse” puts the load on the server. It’s usually some scripts, in which case you definitely have to SSH in to look around.



I got an email from Support telling me they had to throttle my domain because one IP address was downloading the same file over and over again.

Thanks for the help.


Sort of related to this, I’ve wondered if it’s possible to block an IP (temporarily) if it looks like some type of ‘site ripper’ or ‘robot’ rips through my site which might have lots of pics and video files. (I don’t mind if people manually download them by right-clicking) I know about .htaccess and blocking getting dir listings and such…and robots files to prevent the ‘wget’ command from ripping a site. But I wonder if there’s another way to say something like “If an IP address tries to access my site 30 times within 60 secs, then block that IP for 24 hours”… I get the feeling this cannot be done at the ssh level… would the router itself have to be programmed for this?