Understanding Acquia log analysis

Acquia uses an internal monitoring tool to perform a log analysis of recent traffic to your website. The analysis breaks down per-hour traffic reports into a table. The log analysis helps Acquia Support analyze changes to your website’s traffic patterns, or to your website’s response to the patterns.

Acquia Support will sometimes provide the output to subscribers to help them understand what changes took place and when. The output file is densely packed with information; the following documentation can help you to interpret its contents.

Data structure

The following example displays what the output can look like:

Date/Time #Reqs Avg(s) Max(s) #>5s 2XX 3XX 4XX 403 404 5XX
28/Jul/2018:10:XX 40817 0.20 13.66 37 33413 1430 5974 690 5284 0
28/Jul/2018:11:XX 41395 0.24 47.05 125 34743 1490 5158 1168 3990 1
28/Jul/2018:12:XX 52454 0.21 13.02 82 44709 2097 5637 827 4810 9
28/Jul/2018:13:XX 60165 0.20 15.08 54 51330 2393 6439 868 5571 3
28/Jul/2018:14:XX 71464 0.23 10.43 29 62365 2997 6090 824 5266 11
28/Jul/2018:14:XX 71464 0.23 10.43 29 62365 2997 6090 824 5266 11
28/Jul/2018:15:XX 92274 0.26 10.25 116 81635 3777 6857 889 5968 4

In the previous list, each line represents the compilation of an hour’s requests. Every column in this line provides information about the traffic seen in this hour.

Column Description
#Reqs The total number of requests this hour. A larger number can specify a traffic spike.
Avg(s) The average, in seconds, of how long each request took to complete. A larger number would specify an hour where your website’s instances struggled to keep up with demand.
Max(s) The maximum number of seconds the longest request took to complete in this hour.
#>5s How many requests in this hour took more than five seconds to complete.
HTTP:2XX The number of requests this hour responding with an HTTP 2xx status code (a status code between 200 and 299) indicating the request was received and handled as expected. Larger numbers in this column are better.
3XX The number of requests this hour responding with an HTTP 3xx status code (a status code between 300 and 399) indicating a good request, but requiring some kind of redirection to complete.
4XX The number of requests this hour responding with an HTTP 4xx status code (a status code between 400 and 499) which typically indicates a problem (potentially client-side). Two specific 4xx-level status codes are broken out separately in the following columns.
403 Forbidden. The request was a valid request, but the server is refusing to respond to it.
404 Not Found. The requested resource does not exist.
5XX The server has encountered an error (an HTTP status code between 500 and 599). Production environments don’t display full information for HTTP 5xx status codes.

For more information about HTTP status codes, see List of HTTP status codes.

What to look for

When reading this report, Acquia looks for several indicators, including:

  • Did the number of requests spike upward?
  • Did the average response time spike upward?
  • What requests take a tremendously long time to complete?
  • Did the whole ratio between HTTP 2xx/3xx/4xx/5xx status codes change?
  • Are there many requests returning HTTP 5xx status codes?
  • Does the ratio between good (2xx or 3xx) traffic and traffic returning HTTP 404 status codes warrant a fix to the underlying cause of the HTTP 404 status codes or the usage of the Fast 404 module to lessen their effect?

Acquia Support will generally make recommendations and point out where problems exist based on the preceding statistics. Analyzing data, and comparing it to code deploys, media campaigns, or news events can help you understand where to make optimization changes to your website.