What are the most important cPanel log files?

The main access log as well as the error and FTP logs. The access log provides a complete overview, while error and FTP logs deliver security insights.

Where does cPanel log email activity?

Email events like delivery status, spam filtering, and IMAP/POP3 access get logged primarily within the Exim mail log.

How long does cPanel store log entries?

Log rotation is configured under System > Logs in cPanel. This controls how many past log files are stored. Entries will eventually get purged as new logs are created.

Can I view cPanel logs from the command line?

Yes, you can view and tail logs in real-time using the command line via SSH. Useful for monitoring them or when cPanel access is blocked.

Should I be concerned about log sizes?

Monitor log partition sizes in cPanel. Rotate and purge logs before they overload the disk. Large, uncompressed plain text logs can quickly consume substantial disk space.

Where is the path for cPanel logs?

There are many logs for, but you can see the path for most of them in this blog post.

Understanding CPanel Server Logs Guide

For system administrators and website owners managing hosting accounts on a cPanel server, log files represent the single most authoritative source of diagnostic truth. Whether diagnosing a sudden 500 Internal Server Error, investigating malicious brute-force authentication attempts, tracing unhandled PHP fatal exceptions, or resolving slow database queries, knowing where cPanel stores its logs and how to interpret raw access lines is an essential skill.

This technical guide details the directory structure of cPanel log files, provides step-by-step instructions to access logs via the cPanel GUI and SSH command line (tail, grep, awk), breaks down standard Apache/Nginx combined log formatting, and provides actionable troubleshooting workflows.

Core cPanel log files and filesystem locations

Depending on whether you manage a single shared cPanel account or have root access to a Linux VPS or dedicated server, logs are separated across distinct subsystems (see our full cPanel Log Locations reference):

Web Server Access & Error Logs:
- Domain Access Logs: /var/log/apache2/domlogs/example.com or /home/username/access-logs/example.com
- Apache Global Error Log: /var/log/apache2/error_log
- PHP-FPM Error Logs: /opt/cpanel/ea-phpXX/root/usr/var/log/php-fpm/error.log
Mail Server Logs (Exim & Dovecot):
- Exim Main Log: /var/log/exim_mainlog (Tracks all sent, received, and rejected SMTP emails).
- Dovecot IMAP/POP3 Log: /var/log/maillog
FTP & SSH Authentication:
- FTP Transfer Log: /var/log/messages or /var/log/xferlog
- SSH & Authentication Failures: /var/log/secure (RHEL/AlmaLinux) or /var/log/auth.log (Ubuntu/Debian).
cPanel Internal Daemon & License Logs:
- cPanel Core Access & Error Log: /usr/local/cpanel/logs/access_log and /usr/local/cpanel/logs/error_log

How to access logs through the cPanel web interface

Log in to your cPanel account dashboard (e.g. https://yourdomain.com:2083).
Scroll down to the Metrics section:
- Errors: Displays the last 300 entries from the Apache/PHP error log for your account. Ideal for quickly locating script bugs and missing assets.
- Raw Access: Allows you to download compressed .gz archives of raw traffic logs for each domain.
- Visitors / AWStats: Provides visual graphs and parsed metrics on incoming visitor IPs, user agents, referrers, and HTTP response codes.

Decoding raw Apache combined log entries

When inspecting raw access logs, each incoming HTTP request is logged in the standardized NCSA Combined Log Format:

198.51.100.25 - frank [21/Aug/2026:14:32:10 +0000] "GET /wp-login.php HTTP/1.1" 200 4521 "https://google.com" "Mozilla/5.0"

Field-by-field breakdown:

198.51.100.25: Visitor’s IP address (or proxy IP).
-: RFC 1413 identity check (typically omitted/hyphen).
frank: HTTP basic authentication username (if protected by .htpasswd).
[21/Aug/2026:14:32:10 +0000]: Exact UTC timestamp and timezone offset.
"GET /wp-login.php HTTP/1.1": HTTP Request Method, requested URI path, and protocol version.
200: HTTP status code (200 = Success, 301 = Redirect, 403 = Forbidden, 404 = Not Found, 500 = Server Error).
4521: Number of bytes returned in the HTTP response body.
"https://google.com": HTTP Referrer header.
"Mozilla/5.0": Client User-Agent string.

Troubleshooting workflows using SSH command line

For real-time debugging, connect to your server via SSH as root or your cPanel user:

1. Live stream incoming traffic:

tail -f /var/log/apache2/domlogs/yourdomain.com

2. Filter for 500 Internal Server Errors:

grep "HTTP/1.1" 500" /var/log/apache2/domlogs/yourdomain.com

3. Find top 10 most active visitor IPs (Potential DoS):

awk '{print $1}' /var/log/apache2/domlogs/yourdomain.com | sort | uniq -c | sort -nr | head -n 10

4. Trace email delivery failures in Exim:

grep "[email protected]" /var/log/exim_mainlog | grep -E "(**|==)"

Proactive security and disk maintenance

Configure Log Rotation: Avoid partition exhaustion by enabling automatic daily log compression and truncation in WHM under cPanel Log Rotation Configuration.
Automated Threat Blocking: Integrate log monitors with CSF / LFD Firewall to automatically ban IP addresses generating excessive 401/403 authentication failures.
Sanitize Log Exports: Always redact sensitive customer tokens and passwords before sharing log files publicly in support forums.

For high-performance cPanel web hosting with pure NVMe storage, automated backups, and 24/7 technical assistance, explore Aminserve Linux Cloud VPS and Dedicated Server Solutions.