cpanel logs and its locations

cpanel logs and its locations

CPanel proves to be one of the most powerful and easiest web server management tool in all aspects like simplicity, efficiency, controllability  etc. It provides end user as well as Administrators a better way to maintain the websites as well as services. Cpanel provides different versions which is optimized for VPS as well as Dedicated servers. Here I am going to discuss a not so unique but an important aspect of maintaining a webserver, “LOGS”. Linux servers do keep logs of everything.

One good thing that Cpanel Servers do have is that, It logs each and every services and its actions associated with it. Since cpanel makes customization on many services and normal locations of logs may have changed to another location. Also, Cpanel  keeps the log files on same locations across various cpanel server and versions. So by this consistency, any one who knows where to look logs files in any one of the cpanel version wont be confused on another.

Here is some logs location of  main services that cpanel runs on.


Apache is the web server that is typically utilized by cPanel. On cPanel servers, Apache writes high number of logs including each site’s own traffic log.


The access_log is used to log all http requests to the hostname of the server, requests directed at the main or shared servers IPs, or sites that resolve to the server but are no longer hosted on cpanel server.


A life saving logs where all Apache errors, regardless of site, are logged in the error_log. We can grep the errors like what causes 500, 404 etc.


In cpanel structure, each site have its own log files on the domlogs folder. It will be named like a FQDN  (Fully Qualified Domain Name) ie. eg: All http traffic to a particular website will be logged or recorded to this log files.


Exim is the MTA(Mail Transfer Agent) that cPanel normally utilizes. Exim has three primary logs, but mainly only two of these logs contain useful information for us regarding the mail delivery.


The exim_mainlog contains all the interactions made by Exim both incoming and outgoing.


The exim_rejectlog contains all connection attempts that were denied. This info can be found in exim_mainlog as well

cPanel log files

Cpanel logs all http traffic to WHM, webmail, and cPanel access. All cPanel logs are located in the /usr/local/cpanel/logs directory.


This access_log has all the information about the traffic to WHM, cPanel, and webmail over http.


This error_log has all errors that occur when accessing a cPanel related site over http or https.


Cpanel has the ability to let us choose the FTP Deamons in use. We can use either Pure-FTP or ProFTPd. However Regardless of FTP deamon in use, cPanel does log connections, uploads, and downloads. FTP does not have its own log file. All the logs are recorded in system side log location at


All FTP transactions are recorded in messages. They are however interwoven with all over system messages that are logged in this file.

Some more useful logs locations

cPanel logs

Access logs and user actions


Account transfers and misc. logs


Auditing log (account creations, deletions, etc)


Backup logs


Brute force protection (cphulkd) log


Cpanel dnsadmin dns clustering daemon


Cpanel taskqueue processing daemon




EasyApache build logs


Error log


Installation log


License updates and errors


Locale database modifications


Login errors (CPSRVD)








Panic log


Per account bandwidth history (Cached)


Per account bandwidth history (Human Readable)


Service status logs


Tailwatch driver tailwatchd log


Update analysis reporting


Update (UPCP) log


WebDisk (CPDAVD)


Website statistics log


cPanel access log

Access logs and user actions


cPanel apache log

Apache restarts done through cPanel and WHM


Domain access logs


Processing of log splitting


suPHP audit log


Web server and CGI application error log


cPanel email log

Delivery and receipt log


Incoming mail queue


Log of messages rejected based on ACLS or other policies


Unexpected/Fatal error log


IMAP, POP login attempts, transactions, fatal errors and spam scoring

/var/log/maillog /var/log/messages



image courtesy : cpanel

They can be downloaded from

References that I made for the post is from :

Let me know the log locations I missed. I am happy to update the post. Also, hit the comments for anything.