cPanel/WHMLog Cheat Sheet

Day to Day Logs

System

/var/log/messages
General system log: FTP, DNS, SSH, and daemon events.
/var/log/secure
SSH authentication attempts (success and failure).

cPanel / WHM

/usr/local/cpanel/logs/access_log
All HTTP requests to cPanel/WHM/Webmail.
/usr/local/cpanel/logs/error_log
General cPanel & WHM error messages.
/usr/local/cpanel/logs/login_log
cPanel and Webmail login attempts.

Web / Apache / WAF

/var/log/apache2/error_log
Apache and CGI error log.
/var/log/apache2/modsec_audit.log
ModSecurity WAF audit log.
/var/log/apache2/domlogs/
Per-domain Apache access logs (similar to /home/$cpanel_user/access-logs).

Mail (Exim / Dovecot)

/var/log/maillog
IMAP/POP3 logins, local delivery, TLS issues.
/var/log/exim_mainlog
Exim mail transactions (send/receive).

Security / Firewall (CSF/LFD)

/var/log/lfd.log
Login Failure Daemon logs (failed logins, blocks).
/etc/csf/csf.deny
Blocked IP addresses.
/etc/csf/csf.allow
Whitelisted IP addresses.