Home > Help Center > General > Location of cPanel log files

Location of cPanel log files

cPanel uses a graphical interface to make managing individual applications as user friendly as possible, yet most of the processes can be managed through command line, which is the preferred way for administrators and technical support.

cPanel writes information about the majority of the active server processes into text files called logs so that system administrators can review the records and identify the cause for the emergence of the particular situation.

For cPanel users with shared hosting plans this information will also be useful because they will learn what information is collected in cPanel and they can request a custom reports from the technical support.

In this article we will show you where the logs of individual servers and applications are recorded, such as Apache web server, Exim mail server, MySQL database server, ProFTP server, OpenSSH server, Bind DNS server etc. which together build cPanel as the most popular platform for managing hosting services.

General

LocationDescription
/var/log/messagesThis file contains logging attempts and common error messages for the following services: FTP, nameserver daemons, named or bind, MyDNS, PowerDNS, NSD, SSH daemon (sshd), Dovecot mail server.
/var/log/secureThis file contains attempts to login to SSH daemon (sshd).

cPanel & WHM services

Files

The following table shows a list of login attempts in cPanel & WHM:

LocationDescription
/usr/local/cpanel/logs/access_logThis file shows when the cPanel & WHM user accessed their account.

The system displays these records in a standard text format called Common Log Format. Each row displays logging information with the specified syntax.

Common Log Format

FieldDescriptionExample
Authentication methodQuery verification method.s
Client requestThe request that the client sends to the server.GET /.cpanelservicecheck./serviceauth?sendkey=HIDDEN&version=1.2 HTTP / 1.0
HTTP StatusStatus code of the HTTP request.200
IP AddressIP address of the client.192.168.0.24
ReferrerThe URL from which the visitor has accessed the resource.ftp://cpanel.com
Response SizeThe file size of the object sent to the client in bytes.1500
Service portThe port number the customer has specified in the request.2083
The X-Forwarded-For headerThe IP address of the client when the user sends a request through a proxy subdomain.X-Forwarded: for: 192.0.2.60
TimeThe time the visitor accessed the website in MM / DD / YYYY: HH: MM: SS ZZZZ format.10/21/1985: 16: 42: 23 0000
UserA valid cPanel & WHM account name or email address.validuser
User AgentThe browser the visitor uses to access cPanel & WHM.Safari
User-identifierUnused field for user protocol identification. Important : The logs of cPanel & WHM always show a dash (-) for this field.

Files - continued

LocationDescription
/usr/local/cpanel/build/localedatabaselogThis file contains information about edits made by the user.
/usr/local/cpanel/logs/apitokenslogThis file contains the API tokens WHM logs.
/usr/local/cpanel/logs/cpdavderrorlogThis file contains WebDisk error logs.
/usr/local/cpanel/logs/cpdavdsessionlogThis file registers the WebDisk activity.
/usr/local/cpanel/logs/cpgreylistd.logThis file registers the actions of Greylisting (cpgreylistd).
/usr/local/cpanel/logs/cphulkd_errors.logThis file registers Brute Force (cphulkd) errors.
/usr/local/cpanel/logs/cphulkd.logThis file registers the activity of cphulkd daemon.
/usr/local/cpanel/logs/cpwrapd_logThis file registers the activity of cPanel & WHM (cpsrvd).
/usr/local/cpanel/logs/dnsadmin.logThis file registers dnsadmin queries.
/usr/local/cpanel/logs/error_logThis file detects errors in the cPanel profile.
/usr/local/cpanel/logs/incominghttprequests.logThis file registers requests to connect to the cPanel server.
/usr/local/cpanel/logs/license_logThis file registers updates to cPanel licenses and license-related errors.
/usr/local/cpanel/logs/login_logThis file contains attempts to log in to cpsrvd daemon.
/usr/local/cpanel/logs/queueprocd.logThis file contains the cPanel TaskQueue logs for processing the queueprocd daemon.
/usr/local/cpanel/logs/safeapacherestart_logThis file contains information about each reboot of the Apache server.
/usr/local/cpanel/logs/session_logThis file registers users' actions while logged in to their cPanel accounts.
/usr/local/cpanel/logs/setupdbmap_logThis file contains logs associated with the cPanel database.
/usr/local/cpanel/logs/stats_logThis file contains statistics for web bandwidth of all cPanel accounts.
/usr/local/cpanel/logs/tailwatchd_logThis file contains the log files of the Tailwatch driver (tailwatchd).
/usr/local/cpanel/logs/panic_logThis file records severe error logs in the cPanel profile.
/usr/local/cpanel/logs/php-fpm/error.logThis file contains errors in PHP-FPM implementation. These errors include errors for services cpsrvd and cpdavd. Note: The file does not include errors on client sites.
/var/cpanel/php-fpm/USER/logs/slow.logThis file contains scripts that run unusually slow for a user. Note: USER is the name of the cPanel account.
/var/cpanel/php-fpm/USER/logs/error.logThis file registers user errors. Note: USER is the name of the cPanel account.
/var/cpanel.bandwidth.cacheThis file records the cached traffic for each cPanel profile on the server.
/var/cpanel/accounting.logThis file contains action entries in the cPanel account, such as creating and deleting.
/var/log/chkservd.logThis file contains service status logs.
/var/log/cpanel-install.logThis file contains the logins for installing cPanel & WHM.

Directories

The table shows directory directories in cPanel & WHM:

Directory pathDescription
/usr/local/cpanel/logs/cpbackupThis directory contains cPanel backup logs.
/usr/local/cpanel/logs/cpbackup_transporterThis directory contains the logins of cPanel Backup Transporter.
/usr/local/cpanel/logs/easy/apacheThis directory contains logs for creating EasyApache.
/usr/local/cpanel/logs/update_analysisThis directory contains tar files for update.
/var/cpanel/bandwidth/usernameThis directory contains the logs for the traffic used for each account. Note: in this directory username is the username of the cPanel account.
/var/cpanel/logsThis directory contains account logs and other business logs.
/var/cpanel/updatelogsThis directory contains the update logs of the system.
/var/cpanel/logs/mysql_upgrade.logThis directory contains the MySQL upgrade logs in the profile.
/var/cpanel/horde/logThis directory contains the logs of Horde Webmail.
/var/cpanel/squirrelmailThis directory contains the logs of SquirrelMail.
/var/cpanel/roundcube/logThis directory contains the logs of Roundcube Webmail.
/var/cpanel/transfer_sessionThis directory contains subdirectories for session transfer and recovery. Each session subdirectory and session resume contains JSON session logs.

FTP

Files

LocationDescription
/usr/local/apache/domlogs/ftpxferlogThis file contains the FTP transactions logs of all cPanel users who use EasyApache 3.
/etc/apache2/logs/domlogs/ftpxferlogThis file contains the FTP transactions logs of all cPanel users who use EasyApache 4.

Directories

LocationDescription
/usr/local/apache/domlogsThis directory contains FTP transactions logs for all domains in the cPanel account that exist on web servers running Easy Apache 3.
/etc/apache2/logs/domlogsThis directory contains the FTP transactions logs for all domains in the cPanel account that exist on the web servers running Easy Apache 4.

Mail

Files

LocationDescription
/var/log/exim_mainlogThis file contains email delivery logs from the Exim mail server for the domains in the cPanel profile.
/var/log/exim_rejectlogThis file contains a log of letters that the system has rejected due to ACL. For more information, read the Exim Configuration Manager documentation - Basic Editor.
/var/log/exim_paniclogThis file contains the severe error logs on the Exim mail server.
/var/log/maillogThis file contains attempts to login to IMAP and POP3, transactions, fatal errors and scores (scores) from Apache SpamAssassin.

Directories

LocationDescription
/var/spool/exim/inputThis directory contains a log of incoming messages in the queue. For more information, read the Mail Queue Manager documentation. The system divides these diaries into subdirectories that correspond to the number or letter by which the sender's name begins.
/usr/local/cpanel/3rdparty/mailman/logsThis directory contains Mailman Account Logs.

RAM Memory

LocationDescription
/var/log/dcpumon/YYYY/MMM/DDThis file contains information about the processes that consume the most CPU time and RAM. Note: For correct data interpretation, use the /usr/local/cpanel/bin/dcpumonview file.
/var/log/muninThis file contains the Munin logs in the profile. Munin is a cPanel application that displays CPU, Exim, Apache, MySQL, and more. with the rrdtool utility.

MySQL

LocationDescription
/var/lib/mysql/HOSTNAME.errThis file contains information about databases and MySQL errors in the cPanel profile. Note: HOSTNAME represents the hostname of the server.

Webservers

Apache

LocationDescription
/usr/local/apache/domlogs/DOMAINThis file contains information about when a visitor has accessed a site that exists on a web server with EasyApache 3. Note: DOMAIN is a domain in the cPanel account. cPanel users can download their access logs from cPanel > Home > Metrics > Raw Access.
/etc/apache2/logs/domlogs/DOMAINThis file contains information about when a visitor has accessed a site that exists on a web server with EasyApache 4. Note: DOMAIN is a domain in the cPanel account. cPanel users can download their access logs from cPanel > Home > Metrics > Raw Access.
/var/log/apache2/modsec_audit.logThis file contains ModSecurity log information.
/var/log/apache2/suexec_logThis file contains information about SuExec's audit logs. This is useful for diagnosing Internal Server Errors that do not generate the corresponding error log information.
/var/log/apache2/suphp_logThis file contains information about audit logs of the suPHP Apache Module. This is useful when diagnosing Internal Server Errors that do not generate the appropriate error log information.
/var/log/apache2/mod_jk.logThis file contains logs for connecting Tomcat.
/var/log/apache2/error_logThis file contains error logs for web servers and CGI applications.

Tomcat

LocationDescription
/var/log/easy-tomcat7/localhost-access_logThis file contains logs for access to Tomcat.
/var/log/easy-tomcat7/catalina.errThis file contains Tomcat7 error logs. For more information, read the Tomcat documentation.
/var/log/easy-tomcat7/catalina.outThis file contains logs with Tomcat7 output data.

Conclusion

Shared hosting users have only web server access logs, and if they need particular information about their cPanel user, such as log-in mailbox or FTP server, they must contact technical support to generate a custom report.

You should keep in mind that the logs are common to all users of the hosting server and the log files become huge over time as a number of records and file size, which is why over a few days these logs are overwritten (the old information is automatically deleted and in the same file the new information gets saved).

We recommend that you keep track of your sites daily so you can get up to date information from the servers' logs.

Still not finding what you're looking for?

Contact our support team with any additional questions or concerns.

Contact support