How-To

cPanel and Plesk Log Location Reference Guides

by Robert Seefeldt  • 

Ever wonder where the MST looks to investigate events on your server when you submit a ticket? Knowing the locations of various log files for both cPanel and Plesk can be invaluable when trying to understand why, when or how an event occurred on your server.

Below are breakdowns of log file locations for both control panels. Be sure to check the handy (but large) graphic representations of cPanel/WHM log locations at the bottom of the page.

cPanel/WHM Logs

cPanel, WHM & Webmail

  • Login Attempts to cpsrvd /usr/local/cpanel/logs/login_log
  • Account Transfers & Misc. Logs /var/cpanel/logs
  • Per-Account Bandwidth History Human Readable /var/cpanel/bandwidth/(USERNAME)
  • Per-Account Bandwidth History – Cached /var/cpanel/bandwidth.cache/(USERNAME)
  • Service Status Logs /var/log/chkservd.log
  • Error Log for cpsrvd /usr/local/cpanel/logs/error_log
  • Panic Log for cpsrvd /usr/local/cpanel/logs/panic_log
  • Backup Logs /usr/local/cpanel/logs/cpbackup
  • Update (UPCP) Log /var/cpanel/updatelogs/update-(TIMESTAMP).log
  • Mailman Logs /usr/local/cpanel/3rdparty/mailman/logs
  • Auditing Log (Account Creations, Deletions, etc.) /var/cpanel/accounting.log
  • Access Log & User Actions in cpsrvd /usr/local/cpanel/logs/access_log
  • Website Statistics Logs /usr/local/cpanel/logs/stats_log
  • Logs for Specific Webmail Applications
    • SquirrelMail /var/cpanel/squirrelmail
    • RoundCube /var/cpanel/roundcube/log
    • Horde /var/cpanel/horde/log
  • License Updates & Errors /usr/local/cpanel/logs/license_log
  • Brute Force Protection (cPHulkD) Log /usr/local/cpanel/logs/cphulkd.log
  • WebDisk (cpdavd) Log /usr/local/cpanel/logs/cpdavd_error_log
  • Tailwatch Driver (tailwatchd) Log /usr/local/cpanel/logs/tailwatch_log
  • EasyApache Build Logs /usr/local/cpanel/logs/easy/apache/
  • Installation Log /var/log/cpanel*install*

MySQL

  • General Information & Errors /var/lib/mysql/(HOSTNAME).err or
  • /val/log/mysqld.log

FTP (Pure-FTPD, Pro-FTPD)

  • Login Attempts & General Info /var/log/messages
  • FTP Transfer Log /var/log/xferlog is a symbolic link to /usr/local/apache/domlogs/

Mail Retrieval & Spam Protection (Courier, Dovecot, SpamAssassin)

  • IMAP, POP Login Attempts, Transactions, Fatal Errors & Spam Scoring /var/log/maillog and /var/log/messages

Mail Delivery (Exim)

  • Unexpected/Fatal Error Log /var/log/exim_paniclog (Linux)
  • /var/log/exim/paniclog (FreeBSD)
  • Incoming Mail Queue /var/spool/exim/input
  • Log of Messages Rejected Based on ACLs or Other Policies /var/log/exim_rejectlog (Linux) /var/log/exim/rejectlog (FreeBSD)
  • Delivery & Receipt Log /var/log/exim_mainlog (Linux) /var/log/exim/mainlog (FreeBSD)

Named (BIND)

  • Log /var/log/messages

NSD

  • Log /var/log/messages

SSHD

  • SSH Log /var/log/messages

Web Server (Apache/httpd)

  • Domain Access Logs /usr/local/apache/domlogs/(DOMAIN)
  • Web Server & CGI Application Error Log /usr/local/apache/logs/error_log
  • SuExec Audit Log /usr/local/apache/logs/suexec_log
  • SuPHP Audit Log /usr/local/apache/logs/suphp_log

Top Memory & CPU Consumers (dcpumon)

  • Top Processes Consuming CPU & Memory /var/log/dcpumon/(YEAR)/(MONTH)/(DAY)

Plesk Logs

Plesk (sw-cp-serverd)

  • Access Log /usr/local/psa/admin/logs/httpsd_access_log
  • Backups Log /var/lib/dumps/domain.tld/backup_restore.log and
  • /var/lib/dumps/domain.tld/backup_restore.err_log
  • Error Log /var/log/sw-cp-server/error_log
  • Watchdog
  • Migration Log /usr/local/psa/PMM/logs/migration.log
  • Mailman Log /var/log/mailman/error
  • Horde Webmail /var/local/psa-horde/psa-horde.log

FTP (Pro-FTPD)

  • Login Attempts & General Info /var/log/messages
  • FTP Transaction Log /usr/local/psa/var/log/xferlog

Mail Retrieval & Spam Protection

  • IMAP, POP Login Attempts, Transactions, Fatal Errors & Spam Scoring /usr/local/psa/var/log/maillog/var/log/messages

Mail Delivery (Qmail)

  • Transactions, Errors /usr/local/psa/var/log/maillog
  • Queued Mail /usr/local/pas/var/log/smtp_pendings.log

SSHD

  • SSH Log /var/log/messages

Named (BIND)

  • Log /var/log/messages

Web Server (Apache / httpd)

  • Access & Error Logs /var/log/httpd/access_log and /var/log/httpd/error_log
  • Domain Access & Error Logs /var/www/vhosts/domain.tld/statistics/logs/access.log and /var/www/vhosts/domain.tld/statistics/logs/error_log

MySQL

  • General Information & Errors /var/log/mysqld.log

loglocationsposter

Photo by zabdiel

Find out more about ServInt solutions

Starting at $69

Comments
  1. Thanks for posting those links David, both of the links are on the form you fill out before you actually click next http://go.cpanel.net/posters Hope all of you find those useful :) ^MarioRodriguez
  2. The CPanel/WHM log and configuration setup posters are actually available online as PDFs: http://go.cpanel.net/configposter, http://go.cpanel.net/logposter (they only tell you this AFTER you have completed the order form to have them mailed to you).
    David Spector /
  3. As of 2013, the free log locations poster ordering form is at http://cpanel.net/posters/.
    David Spector /
  4. cPanel's update log has changed places: It's not /usr/cpanel, it's /var/cpanel/updatelogs/
  5. If you want the log locations in a poster format, you can get a poster for free from cPanel at http://posters.cPanel.net
    David Grega /
Start the conversation

Robert Seefeldt

Robert Seefeldt

Robert is a member of ServInt’s Managed Services Team.

  • The New York Times
  • The Hill
  • Bloomberg
  • The Seattle Times
  • Computer World
  • Ars Technica
  • MSNBC