Cpanel has its own log locations to store and retrive all the logs information. Below i have drafted almost all the important logs and its location stored in the cpanel server which will be useful for the system administrators to trace the incident easily. Let us start with the server logs.
Kernel Boot & Hardware error logs
- Path : /var/log/dmesg
Use the command ” dmesg ” in the root shell to display all the kernel ring buffer (last 64 K) stored in the memory. Just use ” dmesg > boot.messages ” to store the logs in the separate file, and if you want to clear the dmesg just type ” dmesg -c “.
- Path : /var/log/messages
Use “ tail -f /var/log/message ” to list what is going on with your system and with your dns. This logs helps the admin to find our any form of tcp/udp and other form of attacks.
Bad Login / Logout logs
- Path : /var/log/btmp
Stores all the bad login and logout attempts either failure or success. Just use the lastb command to list all the log in a clear format with date/time etc to trace and block the attack source. This kind of attacks on ssh are normally done using a script with Brute force password crackers.
Login / Logout logs
- Path : /var/log/wtmp
Similar to the bad login/logout this log store the good/authorized system login and logout which can be listed using ” last ” command.
Last Logins Logs
- Path : /var/log/lastlog
Database times of previous user logins. The lastlog file is a database which contains info on the last login of each user. Use the ” lastlog ” command to retrieve the data from the logs.
- Path : /var/log/secure
Logs all daemons which requires PAM Authentication.
Common Cpanel logs
Cpanel Initial Installation Error logs
- Path : /var/log/cpanel*install*
Logs use to record the missing dependency or any error which its encouter during the cpanel installation process including the hardware driver failures/mis-matches.
Cpanel License Error Logs
- Path : /usr/local/cpanel/logs/license_log
License and its updated information’s are stored here, if you are encountering with any license issue just execute the command /usr/local/cpanel/cpkeyclt to update the license from the cpanel.
Cpanel/WHM Accounting Logs
- Path : /var/cpanel/accounting.log
Contains a list of accounting functions performed through WHM, including account removal and creation. So the administrator can make of this logs to check who deleted the account and from which ip etc.
Cpanel/WHM Service Status Logs
- Path : /var/log/chkservd.log
Separate logs for the cpanel’s chkservd daemon which logs the service failure and notifications.
Cpanel Stats Daemon Logs
- Path : /usr/local/cpanel/logs/stats_log
The stats daemon (cpanellogd) logs the output from all stats generators (Awstats, Webalizer, Analog) here.
Cpanel login and access logs
- Path : /usr/local/cpanel/logs/access_log
All the login attempts and logins will be logged in this logs which helps the administrator to check who logged in to the panel on which time/ip address etc.
Cpanel Bandwidth Logs
- Path : /var/cpanel/bandwidth
Files contain a list of the bandwidth history for each account. Each named after their respective user.
Tailwatchd Daemon logs
- Path : /usr/local/cpanel/logs/tailwatchd_log
Logs for daemon configured under tailwatchd ie. cPBandwd, Eximstats, Antirelayd.
Cpanel Ftp logs
Ftp General login and Failure
- Path : /var/log/messages
FTP Data Transactions log
- Path : /var/log/xferlog
Is a symbolic link in most cases to /usr/local/apache/domlogs/ftpxferlog, which contains a history of the transactions made by FTP users.
FTP account Raw logs.
- Path : /usr/local/apache/domlogs/ftp.domainname-ftp_log
Store all the ftp login/transfers ftp commands, client connection status etc.
- Path : /var/log/pureftpd.log
It will be disabled by default and only works if you enable it in the /etc/pure-ftpd.conf .
- Path : /var/log/pro-ftpd.log
It will be disabled by default and only works if you enable it in the /etc/pro-ftpd.conf
Cpanel Mysql logs
MySQL General Information and Errors
- Path : /var/lib/mysql/$(hostname).err
This path could vary, but is generally located in /var/lib/mysql. Could also be located at /var/log/mysqld.log.
Cpanel Apache logs
Apache Access Logs:
- Path : /usr/local/apache/logs/access_log
Complete web server access log records all requests processed by the server.
General Error and Auditing Logs
- Path : /usr/local/apache/logs/error_log
All exceptions caught by httpd along with standard error output from CGI applications are logged here, including apache crash etc.
Apache SuExec Logs
- Path : /usr/local/apache/logs/suexec_log
Auditing information reported by suexec each time a CGI application is executed. Useful for debugging internal server errors, with no relevant information being reported to the Apache error_log, check here for potential suexec policy violations.
Domain Access & error logs
- Path : /usr/local/apache/domlogs/domain.com
General access and error log file for each domain configured with cPanel.
Cpanel Exim logs
Mail Receive and Delivery
- Path : /var/log/exim_mainlog or /var/log/exim/mainlog(FreeBSD)
Receives an entry every time a message is received or delivered.
ACLs/Policies based RejectLog
- Path : /var/log/exim_rejectlog
An entry is written to this log every time a message is rejected based on either ACLs or other policies eg: aliases configured to :fail
Panic/Fatal Errors :
- Path : /var/log/exim_paniclog
Logs any entries exim doesn’t know how to handle. It’s generally a really bad thing when log entries are being written here, and they should be properly investigated
- Path : /var/log/maillog & /var/log/messages
The IMAP, POP, and SpamAssassin services all log here. This includes all general logging information (login attempts, transactions, spam scoring), along with fatal errors.