In short: Key log files on a cPanel server: Apache errors in /usr/local/apache/logs/error_log (or /etc/apache2/logs on newer versions), per-site traffic in the domlogs folder, email in /var/log/exim_mainlog, cPanel and WHM in /usr/local/cpanel/logs, SSH in /var/log/secure and FTP in /var/log/messages.
cPanel keeps its main files in the same place across versions, so you always know where to look for each service’s logs. On newer cPanel versions with EasyApache 4, the Apache paths under /usr/local/apache are links to /etc/apache2.
Apache #
Apache is the web server cPanel normally uses.
- /usr/local/apache/logs/access_log: requests to the server hostname or IP, or to sites that point to the server but are no longer hosted on it.
- /usr/local/apache/logs/error_log: all Apache errors, for every site.
- /usr/local/apache/domlogs/: one log per website (named after the domain), with all HTTP traffic to that site.
Exim (email) #
Exim is the mail transfer agent cPanel uses.
- /var/log/exim_mainlog: all incoming and outgoing mail transactions.
- /var/log/exim_rejectlog: rejected connection attempts (also logged in exim_mainlog).
cPanel and WHM #
All cPanel logs are in /usr/local/cpanel/logs.
- access_log: all access to WHM, cPanel and Webmail.
- error_log: errors that happen when using cPanel services.
FTP #
cPanel logs FTP connections, uploads and downloads to the system log /var/log/messages, mixed with other system messages.
SSH #
SSH logins and authentication are logged in /var/log/secure and /var/log/messages. See how to connect to a server via SSH.
Related service: Hyyat Host server management monitors your server logs and fixes problems for you, with 24/7 support.
