let's examine access logs on haihai.link's web server
summary
i recently added web queries to observe traffic on the static websites as they are hosted on managed web services. however, the webserver host for haihai.link is directly managed by me, so i tried to see what traffic data can be observed directly on the webserver
as haihai.link's frontend uses httpd, i looked at its access logs to examine web traffic
httpd has access logs available under "/var/log/httpd/". examining the files, we can see access logs generated on a weekly basis (e.g. 20260927, 20261004, 20261011). by parsing the contents of a log file, we can get the unique IP addresses
in the screenshot below, i get the unique IP addresses (with the first 2 octets redacted for privacy) from the log file for the period 20260927
a simple count returns 1071 unique IP addresses from the log file - hello web visitors! ( *・∀・)ノ
looking at the other log weekly files there are:
- 1094 unique IPs on the period 20261004
- 1004 unique IPs on the period 20261011
- 1030 unique IPs on the period 20261018
the access logs have lots of information to query from and some columns provide information such as the browser or other software (e.g. bots such as AI and web crawlers). in the screenshot below i query for the unique names of the systems used by clients
welcome, human and bot web visitors _(:3」∠)_
with some parsing of available information, things like endpoint traffic can also be determined as well (i excluded querying for IP address in the screenshot below for privacy)
it should be noted that up to this point, only http requests were counted; we can also include https requests by including the ssl_access_logs as well
to simplify the exercise of retrieving IPs, i made a script to aggregate log entries across both access_log and ssl_access_log files to an output file and then get the count of unique IPs from the produced output file
running the script produces the following output in the screenshot below. we can now see there are 5458 unique IPs from both http and https traffic from all available access logs.
searching for the earliest log entry available, we can see that it is from 09/20/2026
using some parsing we can also print out the aggregate unique IP addresses from the output file (the first 2 octets of IP addresses have been redacted for privacy)
there are a lot of details that can be observed just by observing the logs generated by the webserver. for the webapp itself, it is pretty fun to see other web users visit (and sometimes browse around) aside from just myself
at the time of composing this longpost, it is 10/22/2026, so having 5458 unique IPs visit across 32 days is pretty nice ヽ(・∀・)ﾉ