cPanel logs provide a goldmine of information to resolve various customer issues and server errors quickly. Here’s a list of the cPanel logs most commonly used by us:
cPanel mail logs – SMTP (Exim), POP/IMAP (Courier/Dovecot), and Webmail (Horde/RoundCube/SquirrelMail)
| Incoming and outgoing mail log | /var/log/exim_mainlog | Find out what happened to an email sent to an external server or one that came into this server. |
| POP or IMAP login/transaction records | /var/log/mail log | Find out when a mailbox was accessed, from which IP, and if it was successful. |
| Anti-spam logs (e.g. SpamAssassin) | /var/log/mail log | Find out if a mail was tagged as spam and why. |
| Mails rejected by Exim SMTP server | /var/log/exim_rejectlog | Find out if a mail was rejected at the connection level due to an Exim security policy. |
| SMTP/POP/IMAP server crash logs | /var/log/messages, | Find out why Exim/Courier/Dovecot servers crashed. |
| /var/log/maillog, | ||
| /var/log/exim_paniclog | ||
| Mailman logs | /usr/local/cpanel/3rdparty/mailmain/logs/* | Records under this directory show what happened to various mailing lists. |
| RoundCube delivery and error logs | /var/cpanel/roundcube/log/* | Logs under this directory show mail delivery details and RoundCube access errors. |
| Horde error logs | /var/cpanel/horde/log/* | Records under this directory show Horde errors. |
| SquirrelMail logs | /var/cpanel/squirrelmail/* | Documents related to SquirrelMail errors. |
cPanel web server logs – Apache
| Website access logs | /usr/local/apache/domlogs/[DOMAIN_NAME] | Find out which IP accessed the site at a given time and the access status. |
|---|---|---|
| Web site and server error log | /usr/local/apache/logs/error_log | Details of error returned on the website. |
| Mod Security error log | /usr/local/apache/logs/modsec_audit.log | Details of the mod_security deny error. |
| SuPHP audit log | /usr/local/apache/logs/suphp_log | Find out under which user ownership a script was executed. |
| Apache restarts through cPanel/WHM | /usr/local/cpanel/logs/safeapacherestart_log | Find out at what all times Apache was restarted through WHM. |
cPanel web server logs – Apache
| Brute force protection log | /usr/local/cpanel/logs/cphulkd.log | Check if an IP was blocked by cPHulkd. |
|---|---|---|
| Login failures on all cPanel/Webmail services | /usr/local/cpanel/logs/login_log | Find out at what all times a user could not log in to cPanel/Webmail services. |
| User logins and activity log | /usr/local/cpanel/logs/access_log | Find out what a user did after logging into cPanel. E.g., what did they upload through the file manager? |
| Accounts audit log | /var/cpanel/accounting.log | See the changes to accounts like creation, owner change, deletion, etc. |
| Backup logs | /usr/local/cpanel/logs/cpbackup | See if a budget was successfully backed up and when. |
| Web statistics update log | /usr/local/cpanel/logs/stats_log | See if statistics were processed for a domain. |
| cPanel license update logs | /usr/local/cpanel/logs/license_log | Find if the license update had any errors. |
| Service status logs | /var/log/chkservd.log | Find at what all times various services were responding. |
| Tailwatch daemon log | /usr/local/cpanel/logs/tailwatchd_log | Trace any errors related to the Tailwatch daemon’s working. |
| WebDisk logs | /usr/local/cpanel/logs/cpdavd_error_log | Trace issues associated with Web Disk daemon functioning. |
| Account bandwidth usage | /var/cpanel/bandwidth/[DOMAIN_NAME] | See the history of bandwidth usage for a given domain. |
| cPanel error log | /usr/local/cpanel/logs/error_log | Trace reasons for errors returned by cPanel interfaces. |
| cPanel fatal error log | /usr/local/cpanel/logs/panic_log | Trace reasons for cPanel service crashes. |
| cPanel update log | /var/cpanel/update logs/* | Trace issues related to cPanel updates. |
| EasyApache installation logs | /usr/local/cpanel/logs/easy/apache/* | Cross-verify errors seen in Apache with rebuild times. |
| cPanel installation log | /var/log/cpanel | Trace issues noted in cPanel installation. |
cPanel access log
| Access logs and user actions | /usr/local/cpanel/logs/access_log |
|---|
MySQL log
| MySQL error log | /var/lib/mysql/{SERVER_NAME}.err |
|---|---|
| MySQL slow query log (if enabled in my. cnf) | /var/log/slowqueries |
Important system and 3rd party tools logs
| Cron server log | /var/log/cron | Find out if a cron ran as per schedule. |
|---|---|---|
| Default system log file | /var/log/messages | Most system errors and events will be logged here. |
| LFD firewall log (if CSF/LFD is installed) | /var/log/lfd.log | Find out why an IP was blocked. |
| Maldetect logs (if LMD is installed) | /usr/local/maldetect/event_log | Find out what malware was detected, or why a file upload failed. |
| Server authentication logs | /var/log/secure | Find out who all tried to log in to the server and from which all IPs. |
| Server update log | /var/log/yum.log | Find out what all packages were updated and when. |
Note: This list is based on common paths venders use and can be changed at any time.
FAQ
cPanel and WHM are web hosting control panel software used to manage websites, email accounts, and other hosting-related services.
You can find logs for these services in the following locations:
cPanel logs:
- Access logs: /usr/local/cpanel/logs/access_log
- Error logs: /usr/local/cpanel/logs/error_log
- Account transfer logs: /usr/local/cpanel/logs/transfer_log
WHM logs:
- Access logs: /usr/local/cpanel/logs/access_log
- Error logs: /usr/local/cpanel/logs/error_log
- Backup logs: /usr/local/cpanel/logs/cpbackup
Apache logs:
- Access logs: /usr/local/apache/logs/access_log
- Error logs: /usr/local/apache/logs/error_log
Email logs:
- Exim logs: /var/log/exim_mainlog
- Dovecot logs: /var/log/maillog
- SpamAssassin logs: /var/log/exim_rejectlog
FTP logs:
- Pure-FTPd logs: /var/log/messages
MySQL logs:
- Error logs: /var/lib/mysql/hostname.err
- Slow query logs: /var/lib/mysql/hostname-slow.log
Note: Replace “hostname” with the actual hostname of your server.
You can view logs using a text editor or a log viewer tool. For example, you can use the “tail” command to view the last few lines of a log file: tail /path/to/log/file
When troubleshooting errors, you should look for error messages and warnings in the logs. These messages can help you identify the cause of the problem and take appropriate action. You may also want to search for common error messages online to find solutions or ask for help on forums or support channels.
