Cpanel has own the locations of logs files to store and retrieve the information.
Kernel buffer
tail -F /var/log/dmesg
System Informations
tail -F /var/log/messages
Bad Login / Logout
tail -F /var/log/btmp
Stores all the bad login and logout attempts either failure or success. Just use the lastb command.
Good Login / Logout
tail -F /var/log/wtmp
Similar to the bad login/logout this log store the good/authorized system login and logout which can be listed using last command.
Last Logins
tail -F /var/log/lastlog
Database times of previous user logins. Use the lastlog command.
Authentication
tail -F /var/log/secure
Logs all daemons which requires PAM Authentication.
Cpanel Initial Installation
less /var/log/cpanel ... install ...
Use to record the missing dependency or any error which encouter during the cpanel installation process
Cpanel License Error
less /usr/local/cpanel/logs/license_log
License and update. Use the command /usr/local/cpanel/cpkeyclt to update the license from the cpanel.
Cpanel/WHM Accounting
less /var/cpanel/accounting.log
Contains a list of accounting functions performed through WHM, including account removal and creation.
Cpanel/WHM Service Status
less /var/log/chkservd.log
Separate log of chkservd daemon
Cpanel Stats Daemon
less /usr/local/cpanel/logs/stats_log
The stats daemon (cpanellogd).
Cpanel login and access
tail -F /usr/local/cpanel/logs/access_log
All the login attempts.
Cpanel Bandwidth
tail -F /var/cpanel/bandwidth
The bandwidth history for each account.
Tailwatchd Daemon
tail -F /usr/local/cpanel/logs/tailwatchd_log
cPBandwd, Eximstats, Antirelayd.
Cpanel Ftp
Ftp General login and Failure
tail -F /var/log/messages
FTP Data Transfer
tail -F /var/log/xferlog
This a symbolic link to /usr/local/apache/domlogs/ftpxferlog.
FTP account Raw
tail -F /usr/local/apache/domlogs/ftp.domainname-ftp_log
Store all the ftp login/transfers commands and status
Pure-ftp
tail -F /var/log/pureftpd.log
It should be authorized in the /etc/pure-ftpd.conf.
Pro-ftp
tail -F /var/log/pro-ftpd.log
It should be authorized in the /etc/pro-ftpd.conf.
Cpanel Mysql
tail -F /var/lib/mysql/*.*
May be also located at /var/log.
Cpanel Apache
tail -F /usr/local/apache/logs/access_log
General Error and Auditing
tail -F /usr/local/apache/logs/error_log
Apache SuExec
tail -F /usr/local/apache/logs/suexec_log
Auditing information reported by suexec each time a CGI application is executed.
Domain access
tail -F /usr/local/apache/domlogs/*.*
General access and error log file for each domain configured with cPanel.
Cpanel Exim
tail -F /var/log/exim_mainlog tail -F /var/log/exim_rejectlog tail -F /var/log/exim_paniclog
IMAP/POP
tail -F /var/log/maillog tail -F /var/log/messages