“You can view cPanel access, admin activity, logins and errors for users and resellers on your cPanel server in the following logs:
/usr/local/cpanel/logs/access_log – All activity on cPanel, WHM, and Webmail interfaces
/usr/local/cpanel/logs/login_log – Logins to cPanel, WHM and Webmail
/usr/local/cpanel/logs/error_log – Errors that occur in cPanel
/var/cpanel/accounting.log – Records of cPanel account actions, such as creation, deletion, and suspension
Please note, root access is required to view these log files.
Example SSH/ Terminal commands
List recent actions (eg remove/deletion) in WHM
tail /var/cpanel/accounting.log
Perform a wildcard search for lines containing the pattern “example” with any characters before and after it, you can use the .* wildcard characters:
grep ".*example.*" /usr/local/cpanel/logs/access_log
“