# Reading logs

> The Logs screen: the last lines of any log this server writes — one site's requests, an account's PHP errors, mail, the panel's own services — read by name, never by path.

Source: https://www.corepanel.net/docs/server-logs/
Last updated: 2026-09-03
Part of the CorePanel documentation — https://www.corepanel.net/docs

---

**Server → Logs** shows the tail of any log this server writes, without an SSH session.

It exists for one question above all others: *this site is returning 500s — why?* Two
logs answer it between them, and both are here.

Available on **every edition**. Super-administrators only.

![The Logs screen in CorePanel: a toolbar with a Log picker set to site-access, a Hostname box reading northgate-books.com, a Containing box filtering for 500 and a line count of 100; below it a pane headed with the path /var/log/corehttpd/users/northgate/northgate-books.com.access.log, its size and when it was last written, then the matching access-log lines in a monospace font with each 500 highlighted.](https://www.corepanel.net/_astro/logs-site-access-dark.D8fSLJMp.png)

## Choosing a log

The picker is grouped by what a log covers, because that is what decides whether it needs
anything alongside it:

| Group | Logs | Needs |
|---|---|---|
| One site at a time | `site-access` | a hostname |
| One account at a time | `php-error`, `php-access` | an account |
| The whole server | everything else | nothing |

| Log | What it answers |
|---|---|
| `site-access` | Requests to one hostname, with the status code that was answered |
| `php-error` | PHP warnings, fatals and stack traces, for one account |
| `php-access` | One line per PHP request of an account, with time and memory used |
| `web-error` | The web server's own errors, server-wide |
| `web-access` | Requests to the panel's own hostname |
| `mail` | Postfix and Dovecot |
| `database` | MariaDB: crashes, refused connections, tables it could not open |
| `dns` | The authoritative nameserver: zones it refused, queries it could not answer |
| `ftp` | The FTP daemon: sessions, transfers, connections turned away |
| `panel-core`, `panel-sys`, `panel-api`, `panel-auth` | CorePanel's own services |

Three of those — `database`, `dns` and `ftp` — have no file of their own on a stock
install: MariaDB, PowerDNS and pure-ftpd write to the systemd journal, so that is where
CorePanel reads them from, and the header above the pane says so. A `database` that has
been given a `log_error` is read from the file instead.

A server-wide log that **nothing is writing to** is marked in the picker before you open
it. That is worth more than it sounds: an empty pane and a silent daemon look identical,
and only one of them is a problem.

## Chasing a 500

1. Pick `site-access` and name the site. Type `500` in **Containing** to keep only the
   lines that mention it — the answer to *are the 500s real, how many, and on what path*.
2. Switch to `php-error`. The site's account stays selected, so this is one click. If the
   500 is the code, the fatal is here, with the file and the line.

`web-error` is the third one to try when neither of those explains it: a site that will
not start, a certificate that will not load, an upstream that did not answer.

> **Filtering for a status code**
>
> **Containing** is matched literally, spaces included and nothing trimmed. `500` also
> matches the `38500` of a response size; ` 500 ` with a space either side matches the
> status code and nothing else.
## Access logs are per hostname

`example.com` and `www.example.com` are **two different logs**. A request is recorded
under the name it arrived on, so a site that answers for both writes both, and asking for
one does not show you the other. The hostname box suggests the domains this server hosts
and accepts anything you type, which is how you reach the `www.` log — it is a real log
that is not a row in any list.

Subdomains and addon domains each get their own log too, for the same reason: each has
its own virtual host.

## What "that is all there is" means

Every read is bounded — a line count with a ceiling of 500, a maximum line length, a
total size, and a limit on how far back the file is walked when you filter it. **Whichever
bound fired is stated under the pane**, in words.

That line is the difference between *"that is all there is"* and *"that is all I looked
at"*. Nothing printed means you are looking at the end of the log. "There are older lines
above these" means you are looking at a slice of it, and a match you did not find may
still exist further back.

**Live** re-reads the log every ten seconds. It keeps the pane pinned to the newest line
while you are at the bottom, and stops following as soon as you scroll up to read
something.

## Why there is no download

The screen reads **named** logs — `site-access`, `php-error` — and the list of names, with
the paths behind them, is compiled into the privileged daemon that owns the filesystem.
There is no path box, no download and no "open the raw file", because all three would turn
a bounded read of a known log into file access, which is the property the design exists to
keep.

Control characters in a log line are escaped rather than removed, so an escape sequence
somebody sent in a user agent is inert on screen and still visible to you. Colour is the
one exception: CorePanel's own daemons paint the timestamp and the level of every line
they write to their log files, and those sequences are dropped instead of escaped — they
are decoration of ours, not evidence of anything, and escaping them buried the message
under `\x1b[90m…\x1b[0m`. Colour cannot move the cursor or erase the screen, so nothing
that could rewrite what you are reading is removed along with it.

Reading logs is a super-administrator capability, like the firewall and mail
deliverability: one line of a mail log names three tenants at once. An account holder
signed into the [client panel](https://www.corepanel.net/docs/client-panel) has no version of this screen.

## The same logs from an AI assistant

An assistant connected over [MCP](https://www.corepanel.net/docs/mcp) reads exactly these logs, by the same names,
through the `read_logs` tool — the same allow-list, the same bounds, the same refusals.
*"example.com is returning 500s — what is in its logs?"* is a question it can answer for
itself.

## See also

- [Web Traffic Graphs](https://www.corepanel.net/docs/web-traffic) — request rates and latency, for the whole server
- [The Dashboard](https://www.corepanel.net/docs/dashboard) — which services are up, before you go looking in a log
- [MCP for AI agents](https://www.corepanel.net/docs/mcp) — the same reads, for an assistant