Hosting with cPanel uses a graphical interface to make web hosting super easy, but there are command line tools you could familiarize yourself with for advanced troubleshooting. cPanel logs most activity that happens on a server to log files so you can go back and review log entries for problems, instead of having to be on the server at the time of them happening.
This guide will cover the locations of the cPanel log files for things such as access logs, Apache web server logs, email logs, error logs, ftp logs, MySQL logs, and WHM logs.
If you’d like to have a poster of the 2013 cPanel logs location reference, you can request them from cPanel directly.
You can also view a digitial copy of this poster directly online at go.cPanel.net/logposter.
cPanel logs
| Access logs and user actions | /usr/local/cpanel/logs/access_log |
|---|
| Account transfers and misc. logs | /var/cpanel/logs |
|---|
| Auditing log (account creations, deletions, etc) | /var/cpanel/accounting.log |
|---|
| Backup logs | /usr/local/cpanel/logs/cpbackup |
|---|
| Brute force protection (cphulkd) log | /usr/local/cpanel/logs/cphulkd.log |
|---|
| Cpanel dnsadmin dns clustering daemon | /usr/local/cpanel/logs/dnsadmin_log |
|---|
| Cpanel taskqueue processing daemon | /usr/local/cpanel/logs/queueprocd.log |
|---|
| DBmapping | /usr/local/cpanel/logs/setupdbmap_log |
|---|
| EasyApache build logs | /usr/local/cpanel/logs/easy/apache/ |
|---|
| Error log | /usr/local/cpanel/logs/error_log |
|---|
| Installation log | /var/log/cpanel |
|---|
| License updates and errors | /usr/local/cpanel/logs/license_log |
|---|
| Locale database modifications | /usr/local/cpanel/logs/build_locale_database_log |
|---|
| Login errors (CPSRVD) | /usr/local/cpanel/logs/login_log |
|---|
| Horde | /var/cpanel/horde/log/ |
|---|
| RoundCube | /var/cpanel/roundcube/log/ |
|---|
| SquirrelMail | /var/cpanel/squirrelmail/ |
|---|
| Panic log | /usr/local/cpanel/logs/panic_log |
|---|
| Per account bandwidth history (Cached) | /var/cpanel/bandwidth.cache/{USERNAME} |
|---|
| Per account bandwidth history (Human Readable) | /var/cpanel/bandwidth/{USERNAME} |
|---|
| Service status logs | /var/log/chkservd.log |
|---|
| Tailwatch driver tailwatchd log | /usr/local/cpanel/logs/tailwatch_log |
|---|
| Update analysis reporting | /usr/local/cpanel/logs/updated_analysis/{TIMESTAMP}.log |
|---|
| Update (UPCP) log | /var/cpanel/updatelogs/updated.{TIMESTAMP}.log |
|---|
| WebDisk (CPDAVD) | /usr/local/cpanel/logs/cpdavd_error_log |
|---|
| Website statistics log | /usr/local/cpanel/logs/stats_log |
|---|
cPanel access log
| Access logs and user actions | /usr/local/cpanel/logs/access_log |
|---|
cPanel apache log
| Apache restarts done through cPanel and WHM | /usr/local/cpanel/logs/safeapcherestart_log |
|---|
| Domain access logs | /usr/local/apache/domlogs/{DOMAIN} |
|---|
| Processing of log splitting | /usr/local/cpanel/logs/splitlogs_log |
|---|
| suPHP audit log | /usr/local/apache/logs/suphp_log |
|---|
| Web server and CGI application error log | /usr/local/apache/logs/error_log |
|---|
cPanel email log
| Delivery and receipt log | /var/log/exim_mainlog |
|---|
| Incoming mail queue | /var/spool/exim/input/ |
|---|
| Log of messages rejected based on ACLS or other policies | /var/log/exim_rejectlog |
|---|
| Unexpected/Fatal error log | /var/log/exim_paniclog |
|---|
| IMAP, POP login attempts, transactions, fatal errors and spam scoring | /var/log/maillog | /var/log/messages |
|---|
| Mailman | /usr/local/cpanel/3rdparty/mailmain/logs |
|---|
FTP log
| FTP Files log | /usr/local/apache/domlogs/ftpxferlog |
|---|
| FTP Directory log | /usr/local/apache/domlogs |
|---|
MySQL log
| MySQL error log | /var/lib/mysql/{SERVER_NAME}.err |
|---|
| MySQL slow query log (if enabled in my.cnf) | /var/log/slowqueries |
|---|
NGINX
Note: Ownership must be ‘nginx:nginx’ for cache path.
| NGINX cache | /var/nginx/cache |
|---|
| NGINX access log | /var/log/nginx/access.log |
|---|
| NGINX error log | /var/log/nginx/error.log |
|---|
| cPanel Cache Manager | Some hosting plans also include the cPanel Cache Manager |
|---|
You should now know where to begin looking if you suspect problems on your cPanel server.
I have a Linux server in shared host. Some times MySQL DB failed due to some reason. I would like to see error log files for MySQL. As a user i can’t see log files in terminal. How can i see log files for MySQL DB? Can any one help me
Thanks for getting in touch with us!
If you have a VPS, you can view your MySQL error logs by SSH’ing into the server as root and checking:
/var/lib/mysql/hostname.err
Be sure to replace ‘hostname’ with your actual server hostname. In some server configurations you may use a domain name instead of the server’s hostname.
It may also be helpful to you to log into root WHM and check the currently running MySQL processes under ‘Show MySQL processes’.
If you are not on a VPS, then you cannot get root access. You will need to contact our 24/7 Technical Support team and we will get those details for you!
How to check if the auto-forward which date was set on a mail id
Apologies, but we’re not sure what you are asking about the auto-forwarding for an email address. You can see the auto-fowarding options in the cPanel under the mail section. There is no date for when it is set. You can submit a request to our live technical support team for mail logs that might show when it is applied, but it require that you specify the exact email address you’re searching for.
For me the folder access-logs is locked
How do I open her lock?
thankx
This depends on your account type. If you have a shared account, you will need to request log information for Live Support.
How long will the server keep these logs?
Bryan, this varies by server, and there is not a specific standard for how long logs are kept.
logs folder is logs not log.
/usr/local/apache/logs/error_log
Is there an easy way to email the access_log? Would using php mail() work?
Hi!
Im wondering if anyone can help me…I am an ABSOLUTE newbie to the whole “web design” field and have been asking Google what to do and how to do it as I go along with building my site. Everything was going 100% and I had succeeded in making a pretty good site (in my eyes) …
But now I cant access my website or my wordpress admin page and keep seeing an ERROR 500 message when I try go to my website or wordpress page.
What do I do??
Any help will be so greatly appreciated!!!!
Hello Ryan,
Have you tried moving your .htaccess file to see if it fixes the issue? Generally a 500 error is when the .htaccess has something in it that the server does not like or file permissions. Also spaces at the top of php files can cause this as well. If you look in the apache error log (/usr/local/apache/log/error_log) it should reveal itself.
Best Regards,
TJ Edens
Very helpful information, Thank you very much for this.Because since the very first day of the month i was browsing for the orderly arranged log information,You have done a very good job with this article
GOOD JOB………………
@ Maro you can check these logs from WHM as well if you have installed CSF then go to “Search system Logs” and then select the logs typs which you want to search.. 🙂
The logs above are all just for the last 24 hours right ? If so is there any way to increase them. I just checked the apache logs for one of my server and it only managed to view last 24hrs
Hello Harmeshver Singh,
Thanks for the question. The log files are automatically archived in order to keep them from getting to large. You would need to submit a verified support ticket to request a copy of older logs on the server.
Apologies that I can’t provide a direct answer in this case. However, if you have any further questions or comments, please let us know.
Regards,
Arnel C.
The next natural extension might be to describe how and when to use each log. I know. That’s a tall order! But any guidance for us newbies is good guidance. Thanks!
Thanks for this article
Its great. Most useful information about linux logs. I could not get any where. It seems that now I can see logs info easily. Its not any hurdle and could not stuck for anything about logs. Many thanks 🙂
Its very helpful article. I am newer to the linux and dont know the exact log locations. It seems that I could not look any other article for the logs. Thanks.
I see that the access logs under mail has 356 MB space. Is it a good idea to remove the old logs and it is better to leave it. If need to reduce it, how to do. Thanks.
What you keep and remove is completely up to you. With a log that size, it’s a good idea to remove it if you do not need any information from it.
I think to need Access logs and user actions
To see the log of accessing files and if a website hacked or something like that
Hello Maro,
Thank you for contacting us. You can get to the Raw Access Logs from cPanel.
We also have an article titled I think my website has been hacked that explains how to tell, and what to do if you are hacked.
If you have any further questions, feel free to post them below.
Thank you,
John-Paul
Not sure what happened here, but managed hosting just migrated my wordpress site and database and setup the best VPS hosting plan you have and now a few days later I received 2 email notifications about it and I have no idea what to do about them! Any help would be appreciated.
Here is the first message:
An error was detected which prevented updatenow from completing normally.
Please review the enclosed log for further details
—————————————————————————————————-
[20150124.181602] Detected version ‘11.46.2.3’ from version file.
[20150124.181602] Running version ‘11.46.2.3’ of updatenow.
[20150124.181602] Using mirror ‘74.200.212.130’ for host ‘httpupdate.cpanel.net’.
[20150124.181821] ***** FATAL: Unable to retrieve tier version info: Interrupted system call
[20150124.181821] The Administrator will be notified to review this output when this script completes
[20150124.181821] E Detected events which require user notification during updatenow. Will send iContact the log
Here is the second message:
cPanel not being able to update. Running `/usr/local/cpanel/scripts/updatenow –upcp –log=/var/cpanel/updatelogs/update.1422141361.log` failed, exited with code 255 (signal = 0)
Thank you!
Kenny
Hello Kenny,
As this was something done by the Managed Hosting team, you will likely want to reach out to them to see if they can help. If you do not have any time left with them, you may also want to reach out to our Live Support team for specific configuration and what may be causing the issue.
Kindest Regards,
Scott M
Is there any way to access these log by WHM? not shell?
Because root isn’t allowed to access shell.
Could you clarify which of these logs you need to access? Some of the information may be found via WHM when logged in as root, but not all.
Very helpfull and correct informations.
Very good reference
Really helpful information given.. Thank You for update.