WHM & Cpanel : where search logs messages of all services

Cpanel has own the locations of logs files to store and retrieve the information.

Kernel buffer

tail -F /var/log/dmesg

System Informations

tail -F /var/log/messages

Bad Login / Logout

tail -F /var/log/btmp

Stores all the bad login and logout attempts either failure or success. Just use the lastb command.

Good Login / Logout

tail -F /var/log/wtmp

Similar to the bad login/logout this log store the good/authorized system login and logout which can be listed using last command.

Last Logins

tail -F /var/log/lastlog

Database times of previous user logins. Use the lastlog command.


tail -F /var/log/secure

Logs all daemons which requires PAM Authentication.

Cpanel Initial Installation

less /var/log/cpanel ... install ...

Use to record the missing dependency or any error which encouter during the cpanel installation process

Cpanel License Error

less /usr/local/cpanel/logs/license_log

License and update. Use the command /usr/local/cpanel/cpkeyclt to update the license from the cpanel.

Cpanel/WHM Accounting

less /var/cpanel/accounting.log

Contains a list of accounting functions performed through WHM, including account removal and creation.

Cpanel/WHM Service Status

less /var/log/chkservd.log

Separate log of chkservd daemon

Cpanel Stats Daemon

less /usr/local/cpanel/logs/stats_log

The stats daemon (cpanellogd).

Cpanel login and access

tail -F /usr/local/cpanel/logs/access_log

All the login attempts.

Cpanel Bandwidth

tail -F /var/cpanel/bandwidth

The bandwidth history for each account.

Tailwatchd Daemon

tail -F /usr/local/cpanel/logs/tailwatchd_log

cPBandwd, Eximstats, Antirelayd.

Cpanel Ftp

Ftp General login and Failure

tail -F /var/log/messages

FTP Data Transfer

tail -F /var/log/xferlog

This a symbolic link to /usr/local/apache/domlogs/ftpxferlog.

FTP account Raw

tail -F /usr/local/apache/domlogs/ftp.domainname-ftp_log

Store all the ftp login/transfers commands and status


tail -F /var/log/pureftpd.log

It should be authorized in the /etc/pure-ftpd.conf.


tail -F /var/log/pro-ftpd.log

It should be authorized in the /etc/pro-ftpd.conf.

Cpanel Mysql

tail -F /var/lib/mysql/*.*

May be also located at /var/log.

Cpanel Apache

tail -F /usr/local/apache/logs/access_log

General Error and Auditing

tail -F /usr/local/apache/logs/error_log

Apache SuExec

tail -F /usr/local/apache/logs/suexec_log

Auditing information reported by suexec each time a CGI application is executed.

Domain access

tail -F /usr/local/apache/domlogs/*.*

General access and error log file for each domain configured with cPanel.

Cpanel Exim

tail -F /var/log/exim_mainlog
tail -F /var/log/exim_rejectlog
tail -F /var/log/exim_paniclog


tail -F /var/log/maillog
tail -F /var/log/messages

Leave a Reply

Your email address will not be published. Required fields are marked *


Scroll to top