In a Linux server running WHM/cPanel, logs are stored in several key directories depending on the type of activity being logged.
Here’s a full breakdown of where to find them and how to check their sizes 👇
🧭 Main WHM/cPanel Log Directories
| Log Type | Location | Purpose / Description |
|---|---|---|
| cPanel Access Logs | /usr/local/cpanel/logs/access_log | Logs every login and action performed via cPanel/WHM interface. |
| cPanel Error Logs | /usr/local/cpanel/logs/error_log | Errors related to cPanel and WHM UI or backend scripts. |
| cPanel License Log | /usr/local/cpanel/logs/license_log | Logs communication with the cPanel license server. |
| cPanel Update Log | /var/cpanel/updatelogs/ | Logs of automatic updates (upcp) and maintenance scripts. |
| Mail Logs (Exim) | /var/log/exim_mainlog/var/log/exim_rejectlog/var/log/exim_paniclog | Logs for sent mail, rejected mail, and critical errors respectively. |
| FTP Logs (Pure-FTPd / ProFTPD) | /var/log/messages/var/log/xferlog | File transfer logs. |
| Apache (HTTP) Logs | /usr/local/apache/logs/access_log/usr/local/apache/logs/error_log | Logs all website hits and errors. |
| MySQL Logs | /var/lib/mysql/hostname.err/var/log/mysqld.log | Logs database startup, shutdown, and errors. |
| cPHulk Brute Force Logs | /usr/local/cpanel/logs/cphulkd.log | Logs blocked IPs and login attempts. |
| CSF / LFD Firewall Logs (if installed) | /var/log/lfd.log | Logs login failures, blocks, and alerts. |
| Cron Logs | /var/log/cron | Logs all cron jobs run on the system. |
📦 Check Log Sizes
You can use the following commands to check total or individual log sizes:
🔹 Check size of all logs under /usr/local/cpanel/logs
du -sh /usr/local/cpanel/logs/*
🔹 Check total size of cPanel logs directory
du -sh /usr/local/cpanel/logs
🔹 Check top 10 largest log files on the system
sudo du -ah /var/log /usr/local/cpanel/logs | sort -rh | head -10
Code language: JavaScript (javascript)🔹 Human-readable disk usage summary
df -h
🧹 Optional: Clean or Rotate Logs
If logs become large, you can rotate or clear them safely.
Rotate logs (built-in system)
/usr/local/cpanel/scripts/logrotate
Manually truncate a large log
(Example: clear Apache access log)
> /usr/local/apache/logs/access_log
Code language: JavaScript (javascript)🧩 Tip: Watch Logs in Real-Time
You can monitor specific log activity live:
tail -f /usr/local/cpanel/logs/error_log
I’m a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I have worked at Cotocus. I share tech blog at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow , and SEO strategies at Wizbrand.
Do you want to learn Quantum Computing?
Please find my social handles as below;
Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at WIZBRAND
