A web server records requests from visitors, search crawlers, embedded assets, and automated probes even when the requested path does not exist. The access log therefore exposes missing URLs that a site-only link crawl may never discover.
In the combined log format, the quoted request is immediately followed by the response status, while the referrer appears later in the same row. Matching the literal boundary " 404 isolates that status field without mistaking 404 in a path or user agent for the response code.
The current uncompressed log is suited to a quick check of recent traffic. Log rows are untrusted and can contain sensitive paths, query strings, and forged referrer or user-agent values, so read them without modification and sanitize any excerpt before sharing it.
Steps to find 404 requests in web server access logs:
- Search the current Nginx combined access log for request rows that returned HTTP status 404.
$ sudo grep --fixed-strings '" 404 ' /var/log/nginx/access.log 198.51.100.24 - - [17/Jul/2026:20:18:05 +0000] "GET /missing-product HTTP/1.1" 404 162 "https://www.example.com/archive/" "curl/8.18.0"
The quoted request identifies the method and missing path, and the first quoted field after the response size is the reported referrer. On Ubuntu and Debian, Apache normally uses /var/log/apache2/access.log; a custom access_log or CustomLog directive can select another file.