cPanel and Plesk Log Location Reference Guides

Ever wonder where the MST looks to investigate events on your server when you submit a ticket? Knowing the locations of various log files for both cPanel and Plesk can be invaluable when trying to understand why, when or how an event occurred on your server.

Below are breakdowns of log file locations for both control panels. Be sure to check the handy (but large) graphic representations of cPanel/WHM log locations at the bottom of the page.

cPanel/WHM Logs

cPanel, WHM & Webmail

  • Login Attempts to cpsrvd /usr/local/cpanel/logs/login_log
  • Account Transfers & Misc. Logs /var/cpanel/logs
  • Per-Account Bandwidth History Human Readable /var/cpanel/bandwidth/(USERNAME)
  • Per-Account Bandwidth History – Cached /var/cpanel/bandwidth.cache/(USERNAME)
  • Service Status Logs /var/log/chkservd.log
  • Error Log for cpsrvd /usr/local/cpanel/logs/error_log
  • Panic Log for cpsrvd /usr/local/cpanel/logs/panic_log
  • Backup Logs /usr/local/cpanel/logs/cpbackup
  • Update (UPCP) Log /var/cpanel/updatelogs/update-(TIMESTAMP).log
  • Mailman Logs /usr/local/cpanel/3rdparty/mailman/logs
  • Auditing Log (Account Creations, Deletions, etc.) /var/cpanel/accounting.log
  • Access Log & User Actions in cpsrvd /usr/local/cpanel/logs/access_log
  • Website Statistics Logs /usr/local/cpanel/logs/stats_log
  • Logs for Specific Webmail Applications
    • SquirrelMail /var/cpanel/squirrelmail
    • RoundCube /var/cpanel/roundcube/log
    • Horde /var/cpanel/horde/log
  • License Updates & Errors /usr/local/cpanel/logs/license_log
  • Brute Force Protection (cPHulkD) Log /usr/local/cpanel/logs/cphulkd.log
  • WebDisk (cpdavd) Log /usr/local/cpanel/logs/cpdavd_error_log
  • Tailwatch Driver (tailwatchd) Log /usr/local/cpanel/logs/tailwatch_log
  • EasyApache Build Logs /usr/local/cpanel/logs/easy/apache/
  • Installation Log /var/log/cpanel*install*


  • General Information & Errors /var/lib/mysql/(HOSTNAME).err or
  • /val/log/mysqld.log


  • Login Attempts & General Info /var/log/messages
  • FTP Transfer Log /var/log/xferlog is a symbolic link to /usr/local/apache/domlogs/

Mail Retrieval & Spam Protection (Courier, Dovecot, SpamAssassin)

  • IMAP, POP Login Attempts, Transactions, Fatal Errors & Spam Scoring /var/log/maillog and /var/log/messages

Mail Delivery (Exim)

  • Unexpected/Fatal Error Log /var/log/exim_paniclog (Linux)
  • /var/log/exim/paniclog (FreeBSD)
  • Incoming Mail Queue /var/spool/exim/input
  • Log of Messages Rejected Based on ACLs or Other Policies /var/log/exim_rejectlog (Linux) /var/log/exim/rejectlog (FreeBSD)
  • Delivery & Receipt Log /var/log/exim_mainlog (Linux) /var/log/exim/mainlog (FreeBSD)

Named (BIND)

  • Log /var/log/messages


  • Log /var/log/messages


  • SSH Log /var/log/messages

Web Server (Apache/httpd)

  • Domain Access Logs /usr/local/apache/domlogs/(DOMAIN)
  • Web Server & CGI Application Error Log /usr/local/apache/logs/error_log
  • SuExec Audit Log /usr/local/apache/logs/suexec_log
  • SuPHP Audit Log /usr/local/apache/logs/suphp_log

Top Memory & CPU Consumers (dcpumon)

  • Top Processes Consuming CPU & Memory /var/log/dcpumon/(YEAR)/(MONTH)/(DAY)

Plesk Logs

Plesk (sw-cp-serverd)

  • Access Log /usr/local/psa/admin/logs/httpsd_access_log
  • Backups Log /var/lib/dumps/domain.tld/backup_restore.log and
  • /var/lib/dumps/domain.tld/backup_restore.err_log
  • Error Log /var/log/sw-cp-server/error_log
  • Watchdog
  • Migration Log /usr/local/psa/PMM/logs/migration.log
  • Mailman Log /var/log/mailman/error
  • Horde Webmail /var/local/psa-horde/psa-horde.log


  • Login Attempts & General Info /var/log/messages
  • FTP Transaction Log /usr/local/psa/var/log/xferlog

Mail Retrieval & Spam Protection

  • IMAP, POP Login Attempts, Transactions, Fatal Errors & Spam Scoring /usr/local/psa/var/log/maillog/var/log/messages

Mail Delivery (Qmail)

  • Transactions, Errors /usr/local/psa/var/log/maillog
  • Queued Mail /usr/local/pas/var/log/smtp_pendings.log


  • SSH Log /var/log/messages

Named (BIND)

  • Log /var/log/messages

Web Server (Apache / httpd)

  • Access & Error Logs /var/log/httpd/access_log and /var/log/httpd/error_log
  • Domain Access & Error Logs /var/www/vhosts/domain.tld/statistics/logs/access.log and /var/www/vhosts/domain.tld/statistics/logs/error_log


  • General Information & Errors /var/log/mysqld.log


Photo by zabdiel

Find out more about ServInt solutions

Starting at $27

  • The New York Times
  • The Hill
  • Bloomberg
  • The Seattle Times
  • Computer World
  • Ars Technica