Skip to content

cPanel Log Files Reference

cPanel Core

/usr/local/cpanel/logs/          # System logs dir
/var/cpanel/logs/                # Extra logs dir
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/session_log
/usr/local/cpanel/logs/api_log
/usr/local/cpanel/logs/api_tokens_log
/usr/local/cpanel/logs/incoming_http_requests.log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/panic_log
/usr/local/cpanel/logs/queueprocd.log
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/tailwatchd_log
/usr/local/cpanel/logs/dnsadmin_log
/usr/local/cpanel/logs/cpwrapd_log          # Service Manager
/usr/local/cpanel/logs/safeapacherestart_log
/usr/local/cpanel/logs/setupdbmap_log
/usr/local/cpanel/build/locale_database_log
/usr/local/cpanel/logs/cpdavd_error_log     # Web Disk error
/usr/local/cpanel/logs/cpdavd_session_log   # Web Disk session
/usr/local/cpanel/logs/cpgreylistd.log
/usr/local/cpanel/logs/cphulkd.log          # Brute Force Protection
/usr/local/cpanel/logs/cphulkd_errors.log

cPanel Per-User

/home/USER/.cpanel/logs          # User task queue
/home/USER/logs/DAV-debug.log
/home/USER/logs/DAV-error.log
/home/USER/logs/DAV-io.log
/etc/apache2/logs/domlogs/USER   # User Apache logs

Web Server (Apache)

/var/log/apache2/error_log
/var/log/apache2/access_log
/etc/apache2/logs/domlogs/       # Domain logs dir
/etc/apache2/logs/domlogs/ftpxferlog
/var/log/apache2/modsec_audit.log
/var/log/apache2/suexec_log
/var/log/apache2/suphp_log
/var/log/apache2/mod_jk.log      # Tomcat

  • Access log stats — top 20 IPs (SSL) 

    cat /var/log/apache2/domlogs/*-ssl_log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

  • cPanel traffic log 

    cat /var/log/cpanel-server-traffic/web/traffic-apache.log | awk '{print $NF}' | sort | uniq -c | sort -rn | head -20

PHP & PHP-FPM

/usr/local/cpanel/logs/php-fpm/error.log
/var/cpanel/php-fpm/USER/logs/slow.log
/var/cpanel/php-fpm/USER/logs/error.log
/home/USER/logs/.php.error.log

Database

/var/cpanel/logs/mysql_upgrade.log
/var/log/mysqld.log              # MySQL / MariaDB 5.7+ / 10.3+
/var/lib/mysql/HOSTNAME.err      # MySQL / MariaDB (older)
/var/lib/mysql/mysql-bin.log     # Binary log

Mail

/var/log/exim_mainlog
/var/log/exim_paniclog
/var/log/exim_rejectlog
/var/spool/exim/input            # Exim queued mail
/var/log/maillog                 # Dovecot (RHEL)
/var/log/mail.log                # Dovecot (Ubuntu)
/usr/local/cpanel/3rdparty/mailman/logs/
/home/USER/.z-push/log/z-push.log
/home/USER/.z-push/log/z-push-error.log
  • Dovecot top 20 failed login IPs 
    grep failed /var/log/maillog | awk -F 'rip=' '{print $2}' | awk -F ',' '{print $1}' | sort | uniq -c | sort -rn | head -20

Webmail (Roundcube)

/home/USER/logs/roundcube        # SQLite backend
/var/cpanel/roundcube/log        # MySQL backend
  • Tail Roundcube logs 
    tail -fn0 /home/cpanel_user/logs/roundcube/*

sqlite3 etc/domain.com/account.rcube.db 'select * from carddav_addressbooks;'
  • Fix CalDAV URL issue 
    for db in $(find /home/*/etc/ -name '*.db'); do mv -v $db /tmp/; done

CalDAV Logs

/opt/cpanel-ccs/data/Logs/

WordPress Toolkit

/usr/local/cpanel/3rdparty/wp-toolkit/var/logs/

Backup

/usr/local/cpanel/logs/cpbackup/
/usr/local/cpanel/logs/cpbackup_transporter
/var/log/comet_backup.log
/var/log/comet_backup_runs/
/usr/local/jetapps/var/log/jetbackup5/

JetBackup Documentation

Installation & Updates

/var/log/cpanel-install.log
/usr/local/cpanel/logs/packman/   # EasyApache build logs
/usr/local/cpanel/logs/update_analysis
/var/cpanel/updatelogs

Accounting & Monitoring

/var/cpanel/accounting.log
/var/cpanel.bandwidth.cache
/var/cpanel/bandwidth/USER
/var/cpanel/transfer_sessions
/var/log/chkservd.log            # Service Monitor
/var/log/dcpumon/                # CPU/Mem Monitor
/var/log/munin
  • Read CPU/memory logs 
    /usr/local/cpanel/bin/dcpumonview

General System

/var/log/messages                # System messages (RHEL)
/var/log/syslog                  # Syslog (Ubuntu)
/var/log/secure                  # SSH login attempts
/var/log/cron                    # Cron job execution
/var/log/csf.log                 # ConfigServer Firewall
/var/log/named.log               # BIND DNS

DNS

/usr/local/cpanel/logs/dnsadmin_log
/var/log/named.log

Log File Sizes

  • Skip zero-size entries 

    du -hxd1 /var/log/ | sort | awk '{if ($1 != 0) print}'

  • With human-readable conversion 

    du -xd1 /var/log/* | awk '$1 != 0' | sort -nr | numfmt --to=iec

Paths containing USER or HOSTNAME are per-account placeholders.