Location Description Directory path Description

General / /var/cpanel/updatelogs This directory contains the update logs of the system.
usr/local/cpanel/logs/cpgreylist This file registers the actions of Greylisting (cpgreylistd). /
Location Description
[Link] var/cpanel/logs/mysql_up This directory contains the MySQL upgrade logs in the profile.
/ This file contains logging attempts and common error messages for the following services:
/ [Link]
var/log/mess FTP, nameserver daemons, named or bind, MyDNS, PowerDNS, NSD, SSH daemon (sshd),
usr/local/cpanel/logs/cphulkd_e This file registers Brute Force (cphulkd) errors. /var/cpanel/horde/log This directory contains the logs of Horde Webmail.
ages Dovecot mail server.
[Link] /var/cpanel/squirrelmail This directory contains the logs of SquirrelMail.
/
/ /
var/log/secu This file contains attempts to login to SSH daemon (sshd).
usr/local/cpanel/logs/[Link] This file registers the activity of cphulkd daemon. This directory contains the logs of Roundcube Webmail.
re var/cpanel/roundcube/log
g
/
/ This directory contains subdirectories for session transfer and recovery. Each
cPanel & WHM services usr/local/cpanel/logs/cpwrapd_l This file registers the activity of cPanel & WHM (cpsrvd).
var/cpanel/transfer_sessio
session subdirectory and session resume contains JSON session logs.
n
og
Files. The following table shows a list of login attempts in cPanel & WHM:
/
Location Description usr/local/cpanel/logs/dnsadmin. This file registers dnsadmin queries.
FTP Files
/ log Location Description
usr/local/cpanel/logs/access_lo This file shows when the cPanel & WHM user accessed their account. /usr/local/cpanel/logs/error_log This file detects errors in the cPanel profile. /
This file contains the FTP transactions logs of all cPanel users who use
g / usr/local/apache/domlogs/ftpxf
EasyApache 3.
The system displays these records in a standard text format called Common Log Format. Each row usr/local/cpanel/logs/incomingh This file registers requests to connect to the cPanel server. erlog
displays logging information with the specified syntax. [Link] /
This file contains the FTP transactions logs of all cPanel users who use
/ etc/apache2/logs/domlogs/ftpxf
This file registers updates to cPanel licenses and license-related errors. EasyApache 4.
Common Log Format exim_mainlog usr/local/cpanel/logs/license_log erlog
<= message arrival /usr/local/cpanel/logs/login_log This file contains attempts to log in to cpsrvd daemon. Directories
(= message fakereject /
=> normal message delivery This file contains the cPanel TaskQueue logs for processing the Location Description
usr/local/cpanel/logs/queueproc
-> additional address in same delivery queueprocd daemon.
[Link] /
>> cutthrough message delivery This directory contains FTP transactions logs for all domains in the cPanel account
*> delivery suppressed by -N / usr/local/apache/d
that exist on web servers running Easy Apache 3.
** delivery failed; address bounced usr/local/cpanel/logs/safeapach This file contains information about each reboot of the Apache server. omlogs
== delivery deferred; temporary problem
erestart_log /
This directory contains the FTP transactions logs for all domains in the cPanel account
/ etc/apache2/logs/d
A authenticator name (and optional id and sender) that exist on the web servers running Easy Apache 4.
C SMTP confirmation on delivery usr/local/cpanel/logs/session_lo This file registers users' actions while logged in to their cPanel accounts. omlogs
command list for “no mail in SMTP session” g
CV
D
certificate verification status
duration of “no mail in SMTP session” / Mail
DKIM domain verified in incoming message usr/local/cpanel/logs/setupdbm This file contains logs associated with the cPanel database.
DN distinguished name from peer certificate ap_log Files
DS DNSSEC secured lookups
DT on =>, == and ** lines: time taken for, or to attempt, a delivery
/usr/local/cpanel/logs/stats_log This file contains statistics for web bandwidth of all cPanel accounts. Location Description
F sender address (on delivery lines) / /
H host name and IP address usr/local/cpanel/logs/tailwatchd This file contains the log files of the Tailwatch driver (tailwatchd). This file contains email delivery logs from the Exim mail server for the domains in the
I local interface used var/log/exim_m
_log cPanel profile.
id message id (from header) for incoming message ainlog
K CHUNKING extension used /usr/local/cpanel/logs/panic_log This file records severe error logs in the cPanel profile. /
L on <= and => lines: PIPELINING extension used This file contains errors in PHP-FPM implementation. These errors This file contains a log of letters that the system has rejected due to ACL. For more
/usr/local/cpanel/logs/php- var/log/exim_re
M8S 8BITMIME status for incoming message
include errors for services cpsrvd and cpdavd. Note: The file does not information, read the Exim Configuration Manager documentation - Basic Editor.
P on <= lines: protocol used fpm/[Link] jectlog
on => and ** lines: return path include errors on client sites. /
PRDR PRDR extension used /var/cpanel/php- This file contains scripts that run unusually slow for a user. Note: USER var/log/exim_p This file contains the severe error logs on the Exim mail server.
PRX on <= and => lines: proxy address
fpm/USER/logs/[Link] is the name of the cPanel account. aniclog
Q alternate queue name
QT on => lines: time spent on queue so far /var/cpanel/php- This file registers user errors. Note: USER is the name of the cPanel This file contains attempts to login to IMAP and POP3, transactions, fatal errors and
on “Completed” lines: time spent on queue fpm/USER/logs/[Link] account. /var/log/maillog
scores (scores) from Apache SpamAssassin.
R on <= lines: reference for local bounce
on => >> ** and == lines: router name /var/[Link] This file records the cached traffic for each cPanel profile on the server.
Directories
RT on <= lines: time taken for reception This file contains action entries in the cPanel account, such as creating
S size of message in bytes /var/cpanel/[Link]
and deleting. Location Description
SNI server name indication from TLS client hello
ST shadow transport name /var/log/[Link] This file contains service status logs. This directory contains a log of incoming messages in the queue. For more information,
/
T on <= lines: message subject (topic) /var/log/[Link] This file contains the logins for installing cPanel & WHM. read the Mail Queue Manager documentation. The system divides these diaries into
TFO connection took advantage of TCP Fast Open var/spool/exim/in
subdirectories that correspond to the number or letter by which the sender's name
on => ** and == lines: transport name Directories. The table shows directory directories in cPanel & WHM: put
begins.
U local user or RFC 1413 identity
X TLS cipher suite Directory path Description /
usr/local/cpanel/3
/ This directory contains Mailman Account Logs.
rdparty/mailman
Files - continued usr/local/cpanel/logs/cpba This directory contains cPanel backup logs.
/logs
ckup
Location Description /
/ usr/local/cpanel/logs/cpba This directory contains the logins of cPanel Backup Transporter.
RAM Memory
usr/local/cpanel/build/localedat This file contains information about edits made by the user. ckup_transporter Location Description
abaselog / / This file contains information about the processes that consume the most CPU time
/ usr/local/cpanel/logs/easy/ This directory contains logs for creating EasyApache. var/log/dcpumon/Y and RAM. Note: For correct data interpretation, use the
usr/local/cpanel/logs/apitokensl This file contains the API tokens WHM logs. apache YYY/MMM/DD /usr/local/cpanel/bin/dcpumonview file.
og / This file contains the Munin logs in the profile. Munin is a cPanel application that
/ usr/local/cpanel/logs/upda This directory contains tar files for update. /var/log/munin
displays CPU, Exim, Apache, MySQL, and more. with the rrdtool utility.
usr/local/cpanel/logs/cpdavderr This file contains WebDisk error logs. te_analysis
orlog /
This directory contains the logs for the traffic used for each account. Note: in MySQL
/ var/cpanel/bandwidth/use
usr/local/cpanel/logs/cpdavdses This file registers the WebDisk activity. this directory username is the username of the cPanel account. Location Description
rname
sionlog /var/cpanel/logs This directory contains account logs and other business logs. / This file contains information about databases and MySQL errors in the cPanel
 Location Description
var/lib/mysql/HOSTN
profile. Note: HOSTNAME represents the hostname of the server.
[Link]

Webservers. Apache
Location Description
/ This file contains information about when a visitor has accessed a site that exists on a
usr/local/apache/ web server with EasyApache 3. Note: DOMAIN is a domain in the cPanel account.
domlogs/DOMAI cPanel users can download their access logs from cPanel > Home > Metrics > Raw
N Access.
/ This file contains information about when a visitor has accessed a site that exists on a
etc/apache2/logs/ web server with EasyApache 4. Note: DOMAIN is a domain in the cPanel account.
domlogs/DOMAI cPanel users can download their access logs from cPanel > Home > Metrics > Raw
N Access.
/
var/log/apache2/ This file contains ModSecurity log information.
modsec_audit.log
/
This file contains information about SuExec's audit logs. This is useful for diagnosing
var/log/apache2/s
Internal Server Errors that do not generate the corresponding error log information.
uexec_log
/ This file contains information about audit logs of the suPHP Apache Module. This is
var/log/apache2/s useful when diagnosing Internal Server Errors that do not generate the appropriate error
uphp_log log information.
/
var/log/apache2/ This file contains logs for connecting Tomcat.
mod_jk.log
/
var/log/apache2/e This file contains error logs for web servers and CGI applications.
rror_log

Tomcat
Location Description
/var/log/easy-tomcat7/localhost-
This file contains logs for access to Tomcat.
access_log
This file contains Tomcat7 error logs. For more information, read the Tomcat
/var/log/easy-tomcat7/[Link]
documentation.
/var/log/easy-tomcat7/[Link] This file contains logs with Tomcat7 output data.