In a Linux server running WHM/cPanel, logs are stored in several key directories depending on the type of activity being logged.
Here’s a full breakdown of where to find them and how to check their sizes 👇
🧭 Main WHM/cPanel Log Directories
| Log Type | Location | Purpose / Description |
|---|---|---|
| cPanel Access Logs | /usr/local/cpanel/logs/access_log | Logs every login and action performed via cPanel/WHM interface. |
| cPanel Error Logs | /usr/local/cpanel/logs/error_log | Errors related to cPanel and WHM UI or backend scripts. |
| cPanel License Log | /usr/local/cpanel/logs/license_log | Logs communication with the cPanel license server. |
| cPanel Update Log | /var/cpanel/updatelogs/ | Logs of automatic updates (upcp) and maintenance scripts. |
| Mail Logs (Exim) | /var/log/exim_mainlog/var/log/exim_rejectlog/var/log/exim_paniclog | Logs for sent mail, rejected mail, and critical errors respectively. |
| FTP Logs (Pure-FTPd / ProFTPD) | /var/log/messages/var/log/xferlog | File transfer logs. |
| Apache (HTTP) Logs | /usr/local/apache/logs/access_log/usr/local/apache/logs/error_log | Logs all website hits and errors. |
| MySQL Logs | /var/lib/mysql/hostname.err/var/log/mysqld.log | Logs database startup, shutdown, and errors. |
| cPHulk Brute Force Logs | /usr/local/cpanel/logs/cphulkd.log | Logs blocked IPs and login attempts. |
| CSF / LFD Firewall Logs (if installed) | /var/log/lfd.log | Logs login failures, blocks, and alerts. |
| Cron Logs | /var/log/cron | Logs all cron jobs run on the system. |
📦 Check Log Sizes
You can use the following commands to check total or individual log sizes:
🔹 Check size of all logs under /usr/local/cpanel/logs
du -sh /usr/local/cpanel/logs/*
🔹 Check total size of cPanel logs directory
du -sh /usr/local/cpanel/logs
🔹 Check top 10 largest log files on the system
sudo du -ah /var/log /usr/local/cpanel/logs | sort -rh | head -10
Code language: JavaScript (javascript)🔹 Human-readable disk usage summary
df -h
🧹 Optional: Clean or Rotate Logs
If logs become large, you can rotate or clear them safely.
Rotate logs (built-in system)
/usr/local/cpanel/scripts/logrotate
Manually truncate a large log
(Example: clear Apache access log)
> /usr/local/apache/logs/access_log
Code language: JavaScript (javascript)🧩 Tip: Watch Logs in Real-Time
You can monitor specific log activity live:
tail -f /usr/local/cpanel/logs/error_log
I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.
I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.
Find Trusted Cardiac Hospitals
Compare heart hospitals by city and services — all in one place.
Explore Hospitals
