Location of cPanel Log Files
cPanel logs most activity that happens on a server to log files so you can go back and audit log entries for issues, rather than must be on the server at the season of them happening.
In this article cPanel log file location will cover.
cPanel logs
Cpanel does log all http traffic to WHM, webmail, and cPanel access. All cPanel logs are located in the /usr/local/cpanel/logs directory.
Installation log: /var/log/cpanel
License updates and errors: /usr/local/cpanel/logs/license_log
Locale database modifications: /usr/local/cpanel/logs/build_locale_database_log
Login errors: /usr/local/cpanel/logs/login_log
Account transfers and misc. logs: /var/cpanel/logs
Auditing log: /var/cpanel/accounting.log
Backup logs: /usr/local/cpanel/logs/cpbackup
Brute force protection (cphulkd) log: /usr/local/cpanel/logs/cphulkd.log
Cpanel dnsadmin dns clustering daemon: /usr/local/cpanel/logs/dnsadmin_log
Cpanel taskqueue processing daemon: /usr/local/cpanel/logs/queueprocd.log
DBmapping: /usr/local/cpanel/logs/setupdbmap_log
EasyApache build logs: /usr/local/cpanel/logs/easy/apache/
Horde: /var/cpanel/horde/log/
RoundCube: /var/cpanel/roundcube/log/
Kernel Boot & Hardware error logs: /var/log/dmesg
SquirrelMail: /var/cpanel/squirrelmail/
Panic log: /usr/local/cpanel/logs/panic_log
System Informations: /var/log/messages
Per account bandwidth history (Cached): /var/cpanel/bandwidth.cache/{USERNAME}
Per account bandwidth history: /var/cpanel/bandwidth/{USERNAME}
Service status logs: /var/log/chkservd.log
Tailwatch driver tailwatchd log: /usr/local/cpanel/logs/tailwatch_log
Update analysis reporting: /usr/local/cpanel/logs/updated_analysis/{TIMESTAMP}.log
Update (UPCP) log: /var/cpanel/updatelogs/updated.{TIMESTAMP}.log
WebDisk (CPDAVD): /usr/local/cpanel/logs/cpdavd_error_log
Website statistics log: /usr/local/cpanel/logs/stats_log
Bad Login / Logout logs: /var/log/btmp
Login / Logout logs: /var/log/wtmp
Last Logins Logs: /var/log/lastlog
Authentication logs: /var/log/secure
Tailwatchd Daemon logs: /usr/local/cpanel/logs/tailwatchd_log
cPanel apache log
Apache is the web server that is typically utilized by cPanel. On cPanel servers Apache does write to a rather high number of logs as each site has its own traffic log.
Apache restarts done through cPanel and WHM: /usr/local/cpanel/logs/safeapcherestart_log
Access logs: /usr/local/cpanel/logs/access_log
Error log: /usr/local/cpanel/logs/error_log
Domain access logs: /usr/local/apache/domlogs/{DOMAIN}
Processing of log splitting: /usr/local/cpanel/logs/splitlogs_log
suPHP audit log: /usr/local/apache/logs/suphp_log
Web server and CGI application error log: /usr/local/apache/logs/error_log
cPanel email log
It is a Mail Transfer Agent used by cPanel. Exim has importantly 2 useful logs they are Main log and Reject log. Main log contains all transaction details of mails with incoming and outgoing specifics. Reject log contains all failed transaction details. And IMAP logs have all general details of transaction, failures, etc.
Delivery and receipt log: /var/log/exim_mainlog Incoming mail queue: /var/spool/exim/input/ ACLs/Policies based RejectLog: /var/log/exim_rejectlog Panic/Fatal Errors: /var/log/exim_paniclog IMAP/POP logs: /var/log/maillog & /var/log/messages Mailman: /usr/local/cpanel/3rdparty/mailmain/logs
MySQL log
FTP does not have its own log file; it is connected with Message log of system and hence all details of FTP processes like login/access or failure, transactions or communications are logged in messages of the system.
MySQL error log: /var/lib/mysql/{SERVER_NAME}.err
MySQL slow query log (if enabled in my.cnf): /var/log/slowqueries
cPanel FTP logs
cPanel does log connections, uploads, and downloads. However, FTP does not have its own log file it is instead threaded into the systemside messages log file.
FTP General login and Failure: /var/log/messages FTP Data Transactions log: /var/log/xferlog FTP account Raw logs: usr/local/apache/domlogs/ftp.domainname-ftp_log Pure-FTP log: /var/log/pureftpd.log Pro-FTP log: /var/log/pro-ftpd.log
