The cPanel Log Files – WHM

The cPanel Log Files

Overview

This document describes the location of all of the log files in cPanel & WHM, Webmail, and MySQL®. This document also provides examples of each log file.

The directories and files in this document reflect unaltered configurations on CentOS, CloudLinux™, RedHat Enterprise Linux (RHEL), and Amazon Linux.

Note:

You can alter a log file’s location with a configuration file.

 

General

Filepath
Description
/var/log/messagesThis directory contains the login attempts and general error messages for the following services:

  • FTP
  • The nameserver daemons (named or nsd).
  • MyDNS
  • The SSH daemon (sshd).
  • The Courier mail server.

    Warning:

    We removed the Courier mail server in cPanel & WHM version 54. The Courier mail server only exists for cPanel & WHM version 11.52 and earlier.

  • The Dovecot mail server.
  • Apache SpamAssassin™.

cPanel & WHM services

Files

The following table lists the log files for cPanel & WHM.

Filepath
Description
/usr/local/cpanel/logs/access_logThis file contains records of when a cPanel & WHM user accesses their account.

The system displays these records in a standardized text format, called the Common Log Format. Each line displays log information in the following syntax:

 Click to view…
/usr/local/cpanel/addbandwidth.logThis file contains records of when a user adds bandwidth to a cPanel account.
/usr/local/cpanel/build/locale_database_logThis file contains information about when a user edits a locale.
/usr/local/cpanel/logs/cpdavd_error_logThis file contains WebDisk’s error logs.
/usr/local/cpanel/logs/cpdavd_session_logThis file contains WebDisk’s activity logs.
/usr/local/cpanel/logs/cpgreylistd.logThis file contains the Greylisting daemon’s (cpgreylistd) activity logs.
/usr/local/cpanel/logs/cphulkd_errors.logThis file contains the Brute Force Protection daemon’s (cphulkd) error logs.
/usr/local/cpanel/logs/cphulkd.logThis file contains the cphulkd daemon’s activity logs.
/usr/local/cpanel/logs/cpwrapd_logThis file contains the cPanel & WHM service manager daemon’s (cpsrvd) activity logs.
/usr/local/cpanel/logs/dnsadmin.logThis file contains dnsadmin request logs.
/usr/local/cpanel/logs/error_logThis file contains the cPanel account’s error logs.
/usr/local/cpanel/logs/incoming_http_requests.logThis file contains the logs of connection requests to the cPanel account’s server.
/usr/local/cpanel/logs/license_logThis file contains the cPanel account’s license update logs and license errors.
/usr/local/cpanel/logs/login_logThis file contains the login attempts to the cpsrvd daemon.
/usr/local/cpanel/logs/queueprocd.logThis file contains the cPanel TaskQueue Processing daemon’s (queueprocd) logs.
/usr/local/cpanel/logs/safeapacherestart_logThis file contains information about each time that Apache restarted on the server.
 
/usr/local/cpanel/logs/session_logThis file contains logs of a user’s activities while they are logged into the cPanel account.
/usr/local/cpanel/logs/setupdbmap_logThis file contains the cPanel account’s database-related activities.
usr/local/cpanel/logs/stats_logThis file contains the bandwidth statistics for all of the server’s cPanel accounts.
usr/local/cpanel/logs/tailwatchd_logThis file contains the Tailwatch Driver’s (tailwatchd) logs.
/usr/local/cpanel/logs/panic_logThis file contains a cPanel account’s severe error logs.

Warning:

This file should not contain any entries. If this file contains entries, thoroughly investigate the entries and contact your hosting provider.

/usr/local/cpanel/logs/php-fpm/error.logThis file contains the PHP-FPM implementation’s errors. These errors include errors for the cpsrvd and cpdavd services.

This file does not include errors for customer sites.

/var/cpanel/php-fpm/USER/logs/slow.logThis file contains scripts that run unusually slow for a user.

Note:

USER represents the cPanel account name.

 

 

/var/cpanel/php-fpm/USER/logs/error.logThis file contains the user’s error logs.

Note:

USER represents the cPanel account name.

/var/cpanel.bandwidth.cacheThis file contains the cached bandwidth history for each cPanel account on your server.
/var/cpanel/accounting.logThis file contains records of cPanel account actions, such as creation and deletion.
/var/log/chkservd.logThis file contains the service status logs.
/var/log/cpanel-install.logThis file contains the cPanel & WHM installation logs.
 

Directories

The following table lists the log directories for cPanel & WHM.

Directory path
Description
/usr/local/cpanel/logs/cpbackupThis directory contains the cPanel backup log files.
/usr/local/cpanel/logs/cpbackup_transporterThis directory contains the cPanel Backup Transporter’s log files.
/usr/local/cpanel/logs/easy/apacheThis directory contains the EasyApache build log files.
/usr/local/cpanel/logs/update_analysisThis directory contains the update process’s .tar files.
/var/cpanel/bandwidth/usernameThis directory contains each account’s bandwidth usage logs, where username represents your username.
/var/cpanel/logsThis directory contains account transfer log files and other, miscellaneous log files.
 
/var/cpanel/updatelogs

 

This directory contains the system’s update log files.

 

/var/cpanel/logs/mysql_upgrade.logThis directory contains the account’s MySQL upgrade logs.
/var/cpanel/horde/logThis directory contains the log files for Horde.
/var/cpanel/squirrelmailThis directory contains the log files for SquirrelMail.

 

/var/cpanel/roundcube/logThis directory contains the log files for Roundcube Webmail.

 

 

FTP

File

Filepath
Description
/usr/local/apache/domlogs/ftpxferlogThis directory contains the FTP transaction logs for all of the cPanel account’s users.

Directory

Directory path
Description
/usr/local/apache/domlogsThis directory contains the FTP transaction logs for all of the cPanel account’s domains.
 

Mail

Files

Filepath
Description
/var/log/exim_mainlogThis file contains Exim’s mail receipt and delivery logs for the cPanel account’s domains.
 
/var/log/exim_rejectlogThis file contains a log of messages that the system rejected due to ACLs.

 

/var/log/exim_paniclogThis file contains Exim’s severe error logs.

Warning:

This file should not contain any entries. If this file contains entries, thoroughly investigate the entries and contact your hosting provider.

/var/log/maillogThis file contains IMAP and POP3 login attempts, transactions, fatal errors, and Apache SpamAssassin scores.
 

Directories

Directory path
Description
/var/spool/exim/inputThis directory contains a log of queued incoming email messages.

The system separates these logs in to subdirectories that correspond to the number or letter with which the sender’s name begins.

/usr/local/cpanel/3rdparty/mailman/logsThis directory contains the account’s Mailman logs.
 

Memory usage

Filepath
Description
/var/log/dcpumon/YYYY/MMM/DDThis file contains information about the processes that consume the most CPU and memory.

  • YYYY represents a subdirectory that contains a process’s logs by month.
  • MMM represents a subdirectory within the YYYY directory that contains a process’s logs for each day of a month.
  • DD represents a subdirectory that contains a process’s log for a specific day of the month.

Note:

To interpret the data, use the /usr/local/cpanel/bin/dcpumonview file.

/var/log/muninThis file contains the account’s Munin logs.

Munin is a cPanel plugin that displays information about CPU, Exim, Apache, MySQL usage, and other information with the rrdtool utility.

MySQL

Filepath
Description
/var/lib/mysql/HOSTNAME.errThis file contains information about the cPanel account’s MySQL databases and errors.

Note:

HOSTNAME represents the account’s hostname.

Web servers

Apache

Filepath
Description
Filepath
Description
/usr/local/cpanel/logs/safeapacherestart.logThis file contains information about each time that Apache restarts via cPanel & WHM, and how much time the system required for each restart.
/usr/local/apache/domlogs/DOMAINThis file contains information about when a visitor accessed a domain, where DOMAIN represents a domain on the cPanel account.

Note:

cPanel users can download their access logs in cPanel’s Raw Access interface (Home >> Metrics >> Raw Access).

 
/usr/local/apache/logs/modsec_audit.log

Important:

If the Apache MPM_ITK module or Mod_Ruid2 is enabled, you can access the logs in the /usr/local/apache/modsec_audit/userdirectory.

This file contains the log information for ModSecurity™.
 
/usr/local/apache/logs/suexec_logThis file contains information about suExec audit logs. This is useful, for example, to diagnose internal server errors that do not produce relevant information in the error log.
 

Note:

You can also view Apache’s error logs in cPanel’s Errors interface (Home >> Metrics >> Errors).

/usr/local/apache/logs/suphp_logThis file contains information about the suPHP Apache module audit logs. This is useful, for example, to diagnose internal server errors that do not produce relevant information in the error log.
/usr/local/apache/logs/mod_jk.logThis file contains the Tomcat connection logs.
/usr/local/apache/logs/error_logThis file contains the error logs for Web Servers and CGI Applications.

Tomcat

Filepath
Description
/var/log/easy-tomcat7/localhost-access_logThis file contains the Tomcat access logs.
 
/var/log/easy-tomcat7/catalina.errThis file contain the Tomcat7 error logs.

 

 
/var/log/easy-tomcat7/catalina.outThis file contain the Tomcat7 output logs.
 

 

Was this article helpful?

Related Articles

Leave A Comment?

You must be logged in to post a comment.