cpanel logs and its locations

CPanel proves to be one of the most powerful and easiest web server management tool in all aspects like simplicity, efficiency, controllability  etc. It provides end user as well as Administrators a better way to maintain the websites as well as services. Cpanel provides different versions which is optimized for VPS as well as Dedicated servers. Here I am going to discuss a not so unique but an important aspect of maintaining a webserver, “LOGS”. Linux servers do keep logs of everything.

One good thing that Cpanel Servers do have is that, It logs each and every services and its actions associated with it. Since cpanel makes customization on many services and normal locations of logs may have changed to another location. Also, Cpanel  keeps the log files on same locations across various cpanel server and versions. So by this consistency, any one who knows where to look logs files in any one of the cpanel version wont be confused on another.

Here is some logs location of  main services that cpanel runs on.

Apache

Apache is the web server that is typically utilized by cPanel. On cPanel servers, Apache writes high number of logs including each site’s own traffic log.

/usr/local/apache/logs/access_log

The access_log is used to log all http requests to the hostname of the server, requests directed at the main or shared servers IPs, or sites that resolve to the server but are no longer hosted on cpanel server.

/usr/local/apache/logs/error_log

A life saving logs where all Apache errors, regardless of site, are logged in the error_log. We can grep the errors like what causes 500, 404 etc.

/usr/local/apache/domlogs

In cpanel structure, each site have its own log files on the domlogs folder. It will be named like a FQDN  (Fully Qualified Domain Name) ie. Domain.com eg: teksupport.in. All http traffic to a particular website will be logged or recorded to this log files.

Exim

Exim is the MTA(Mail Transfer Agent) that cPanel normally utilizes. Exim has three primary logs, but mainly only two of these logs contain useful information for us regarding the mail delivery.

/var/log/exim_mainlog

The exim_mainlog contains all the interactions made by Exim both incoming and outgoing.

/var/log/exim_rejectlog

The exim_rejectlog contains all connection attempts that were denied. This info can be found in exim_mainlog as well

cPanel log files

Cpanel logs all http traffic to WHM, webmail, and cPanel access. All cPanel logs are located in the /usr/local/cpanel/logs directory.

/usr/local/cpanel/logs/access_log

This access_log has all the information about the traffic to WHM, cPanel, and webmail over http.

/usr/local/cpanel/logs/error_log

This error_log has all errors that occur when accessing a cPanel related site over http or https.

FTP

Cpanel has the ability to let us choose the FTP Deamons in use. We can use either Pure-FTP or ProFTPd. However Regardless of FTP deamon in use, cPanel does log connections, uploads, and downloads. FTP does not have its own log file. All the logs are recorded in system side log location at

/var/log/messages

All FTP transactions are recorded in messages. They are however interwoven with all over system messages that are logged in this file.

Some more useful logs locations

cPanel logs

Access logs and user actions

/usr/local/cpanel/logs/access_log

Account transfers and misc. logs

/var/cpanel/logs

Auditing log (account creations, deletions, etc)

/var/cpanel/accounting.log

Backup logs

/usr/local/cpanel/logs/cpbackup

Brute force protection (cphulkd) log

/usr/local/cpanel/logs/cphulkd.log

Cpanel dnsadmin dns clustering daemon

/usr/local/cpanel/logs/dnsadmin_log

Cpanel taskqueue processing daemon

/usr/local/cpanel/logs/queueprocd.log

DBmapping

/usr/local/cpanel/logs/setupdbmap_log

EasyApache build logs

/usr/local/cpanel/logs/easy/apache/

Error log

/usr/local/cpanel/logs/error_log

Installation log

/var/log/cpanel

License updates and errors

/usr/local/cpanel/logs/license_log

Locale database modifications

/usr/local/cpanel/logs/build_locale_database_log

Login errors (CPSRVD)

/usr/local/cpanel/logs/login_log

Horde

/var/cpanel/horde/log/

RoundCube

/var/cpanel/roundcube/log/

SquirrelMail

/var/cpanel/squirrelmail/

Panic log

/usr/local/cpanel/logs/panic_log

Per account bandwidth history (Cached)

/var/cpanel/bandwidth.cache/{USERNAME}

Per account bandwidth history (Human Readable)

/var/cpanel/bandwidth/{USERNAME}

Service status logs

/var/log/chkservd.log

Tailwatch driver tailwatchd log

/usr/local/cpanel/logs/tailwatch_log

Update analysis reporting

/usr/local/cpanel/logs/updated_analysis/{TIMESTAMP}.log

Update (UPCP) log

/var/cpanel/updatelogs/updated.{TIMESTAMP}.log

WebDisk (CPDAVD)

/usr/local/cpanel/logs/cpdavd_error_log

Website statistics log

/usr/local/cpanel/logs/stats_log

cPanel access log

Access logs and user actions

/usr/local/cpanel/logs/access_log

cPanel apache log

Apache restarts done through cPanel and WHM

/usr/local/cpanel/logs/safeapcherestart_log

Domain access logs

/usr/local/apache/domlogs/{DOMAIN}

Processing of log splitting

/usr/local/cpanel/logs/splitlogs_log

suPHP audit log

/usr/local/apache/logs/suphp_log

Web server and CGI application error log

/usr/local/apache/logs/error_log

cPanel email log

Delivery and receipt log

/var/log/exim_mainlog

Incoming mail queue

/var/spool/exim/input/

Log of messages rejected based on ACLS or other policies

/var/log/exim_rejectlog

Unexpected/Fatal error log

/var/log/exim_paniclog

IMAP, POP login attempts, transactions, fatal errors and spam scoring

/var/log/maillog /var/log/messages

Mailman

/usr/local/cpanel/3rdparty/mailmain/logs

cPanle has provided a poster regarding the locations of logs

various log locations of cpanel servers

image courtesy : cpanel

They can be downloaded from http://cpanel.net/posters/

References that I made for the post is from :

http://kb.liquidweb.com/locations-of-common-log-files-on-cpanel-servers/

http://www.inmotionhosting.com/support/website/getting-started-guides/cpanel-logs-for-access-apache-email-error-ftp-mysql-whm

Let me know the log locations I missed. I am happy to update the post. Also, hit the comments for anything.

Get more stuff like this
in your inbox

Subscribe to our mailing list and get interesting stuff and updates to your email inbox.

Thank you for subscribing.

Something went wrong.

Leave a Reply

Your email address will not be published. Required fields are marked *

Get more stuff like this
in your inbox

Subscribe to our mailing list and get interesting stuff and updates to your email inbox.

Thank you for subscribing.

Something went wrong.