cPanel logs is a honeypot of information to quickly resolve various issues and server errors.
Below is a list of the cPanel logs most commonly used by cPanel administrators, and the commonly sought information in them.
cPanel mail logs
Incoming and outgoing mail log:-
To find what happened to email’s sent to an outside server, or one that came into this server.
- /var/log/exim_mainlog
POP or IMAP login or transaction records:-
To find out when the mailbox was accessed, using which IP, and if it was successful.
- /var/log/maillog
Anti-spam logs “SpamAssassin” :-
To find out if a mail was tagged as spam and what was the reason for it.
- /var/log/maillog
Emails rejected by Exim SMTP sever:-
- /var/log/exim_rejectlog
To find out if a mail was rejected at connection level due to an Exim security policy.
Mailman logs
- /usr/local/cpanel/3rdparty/mailmain/logs/*
This Logs under the directory will shows what happened to various mailing lists.
SMTP, POP & IMAP server crash logs
- /var/log/maillog
- /var/log/messages
- /var/log/exim_paniclog
Find out why Exim or Dovecot servers crashed.
SquirrelMail logs
- /var/cpanel/squirrelmail/*
Logs related to SquirrelMail errors.
RoundCube delivery and error logs
- /var/cpanel/roundcube/log/*
Logs under this directory shows mail delivery details and RoundCube access errors.
Horde error logs
- /var/cpanel/horde/log/*
This Logs under the directory show Horde errors.
cPanel FTP logs
File upload logs
- /usr/local/apache/domlogs/ftp.[DOMAIN_NAME]-ftp_log
To find out which IP uploaded the files, under which user ownership, and status of upload.
MySQL log
MySQL error log
- /var/lib/mysql/[HOSTNAME].err
Find out what caused a database server crash.
MySQL slow query log
- /var/log/slowqueries
Find out which database and user has un-optimized queries.
cPanel web server logs
Web site and server error_log
- /usr/local/apache/logs/error_log
Details of error returned in the web site.
Web site access logs
- /usr/local/apache/domlogs/[YOURDOMAINNAME]
To find out which IP accessed the site at given time, and the status of access.
Mod Security error log
- /usr/local/apache/logs/modsec_audit.log
Details of the mod_security deny error.
SuPHP audit log
- /usr/local/apache/logs/suphp_log
Find out under which user ownership a script was executed.
Apache restarts through cPanel/WHM
- /usr/local/cpanel/logs/safeapacherestart_log
Find out at what all times Apache was restarted through WHM.
SuPHP audit log
- /usr/local/apache/logs/suphp_log
Find out under which user ownership a script was executed.
Apache restarts through cPanel/WHM
- /usr/local/cpanel/logs/safeapacherestart_log
Find out at what all times Apache was restarted through WHM.
3rd party tools logs
Cron server log
- /var/log/cron
To find out if a cron ran as per schedule.
Default system log file
- /var/log/messages
Most system errors and events will be logged here.
LFD firewall log (if CSF/LFD is installed)
- /var/log/lfd.log
To find out why an IP was blocked.
Maldetect logs (if LMD is installed)
- /usr/local/maldetect/event_log
To find out what malware was detected, or why a file upload failed.
Server authentication logs
- /var/log/secure
To find out who all tried to login to the server, and from which all IPs.
Server update log
- /var/log/yum.log
To find out what all packages were updated, and when.
