cPanel & WHM logs location

On a cPanel web server there are many logs. We made here a list of them:

cPanel, WHM and Webmail
Access logs and user actions /usr/local/cpanel/logs/access_log
Account transfers and misc. logs /var/cpanel/logs
Auditing log (account creations, deletions, etc) /var/cpanel/accounting.log
Backup logs /usr/local/cpanel/logs/cpbackup
Backup transport logs /usr/local/cpanel/logs/cpbackup_transporter.log
Boxtrapper log ~/mail/MAILDIR/boxtrapper/log
Brute force protection (cphulkd) log /usr/local/cpanel/logs/cphulkd.log
Brute force protection (cphulkd) error log /usr/local/cpanel/logs/cphulkd_errors.log
cPanel dnsadmin dns clustering daemon /usr/local/cpanel/logs/dnsadmin_log
cPanel taskqueue processing demon /usr/local/cpanel/logs/queueprocd.log
Dbmapping /usr/local/cpanel/logs/setupdbmap_log
EasuApache build logs /usr/local/cpanel/logs/easy/apache/
Error log /usr/local/cpanel/logs/error_log
Installation log /var/log/cpanel-install.log
License updates & errors /usr/local/cpanel/logs/license_log
Locale database modifications /usr/local/cpanel/logs/build_locale_databases_log
Login errors (cpsrvd) /usr/local/cpanel/logs/login_log
Logs for all incoming requests for cpsrvd /usr/local/cpanel/logs/incoming_http_requests.log
Horde Webmail /var/cpanel/horde/log/
RoundCube Webmail /var/cpanel/roundcube/log/
SquirrelMail Webmail /var/cpanel/squirrelmail/ (nothing logged)
MySQL upgrade log /var/cpanel/logs/mysql_upgrade.log
Panic log /usr/local/cpanel/logs/panic_log
Per-account bandwidth history – cached /var/cpanel/bandwidth.cache/{username}
Per-account bandwidth history human readable /var/cpanel/bandwidth/{username}
Service status logs /var/log/chkservd.log
Tailwatchd log /usr/local/cpanel/logs/tailwatch_log
Update analysis reporting /usr/local/cpanel/logs/update_analysis/{TIMESTAMP}.log
Update (upcp) log /var/cpanel/updatelogs/update.{TIMESTAMP}.log
Webdisk (cpdavd) log /usr/local/cpanel/logs/cpavd_error_log
Website statistics log /usr/local/cpanel/logs/stats_log
cPanel support access /var/cpanel/logs/supportauth/audit.log

 

FTP (Pure-FTPD,Pro-FTPD)
FTP transaction log /usr/local/apache/domlogs/
Log for FTP transfers /usr/local/apache/domlogs/ftpxferlog
Login attempts/general info /var/log/messages

 

Named (BIND), NSD, MyDNS, SSHD
Login attempts/general info /var/log/messages

 

Mail delivery (Exim)
Delivery & receipt log /var/log/exim_mainlog
Incoming mail queue /var/spool/exim/input/
Log of messages rejected based on ACLs or other policies /var/log/exim_rejectlog
Unexpected/fatal error log /var/log/exim_paniclog

 

Mail retrieval & Spam Protection (Courier, Dovecot, SpamAssassin)
IMAP/POP login attempts, transactions, fatal errors and spam scoring

/var/log/maillog

/var/log/messages

 

Mailman
Logs /usr/local/cpanel/3rdparty/mailman/logs

 

MySQL/MariaDB
General information and errors /var/lib/mysql/{HOSTNAME}.err

 

Munin
Log for munin /var/log/munin

 

Top Memory and CPU Consumers (dcpumon)
Top processes consuming CPU & Memory /var/log/dcpumon/{YEAR}/{MONTH}/{DAY}

 

Web Server (Apache/httpd)
Apache restarts done through cPanel/WHM /usr/local/cpanel/logs/safeapacherestart_log
Domain access logs /usr/local/apache/domlogs/{DOMAIN}
Mod Security /usr/local/apache/logs/modsec_audit.log
Processing of log splitting /usr/local/cpanel/logs/splitlogs_logs
Suexec audit log /usr/local/apache/logs/suexec_log
suPHP audit log /usr/local/apache/logs/suphp_log
Web server & CGI application error log /usr/local/apache/logs/error_log

References

http://go.cpanel.net/logposter

The cPanel Log Files

Share this post: