{"id":53891,"date":"2025-10-16T10:42:33","date_gmt":"2025-10-16T10:42:33","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=53891"},"modified":"2025-10-16T10:42:33","modified_gmt":"2025-10-16T10:42:33","slug":"whm-cpanel-log-directories","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/whm-cpanel-log-directories\/","title":{"rendered":"WHM\/cPanel Log Directories"},"content":{"rendered":"\n

In a Linux server running WHM\/cPanel<\/strong>, logs are stored in several key directories depending on the type of activity being logged.
Here\u2019s a full breakdown of where to find them and how to check their sizes<\/strong> \ud83d\udc47<\/p>\n\n\n\n

\n\n\n\n

\ud83e\udded Main WHM\/cPanel Log Directories<\/strong><\/h3>\n\n\n\n
Log Type<\/strong><\/th>Location<\/strong><\/th>Purpose \/ Description<\/strong><\/th><\/tr><\/thead>
cPanel Access Logs<\/strong><\/td>\/usr\/local\/cpanel\/logs\/access_log<\/code><\/td>Logs every login and action performed via cPanel\/WHM interface.<\/td><\/tr>
cPanel Error Logs<\/strong><\/td>\/usr\/local\/cpanel\/logs\/error_log<\/code><\/td>Errors related to cPanel and WHM UI or backend scripts.<\/td><\/tr>
cPanel License Log<\/strong><\/td>\/usr\/local\/cpanel\/logs\/license_log<\/code><\/td>Logs communication with the cPanel license server.<\/td><\/tr>
cPanel Update Log<\/strong><\/td>\/var\/cpanel\/updatelogs\/<\/code><\/td>Logs of automatic updates (upcp) and maintenance scripts.<\/td><\/tr>
Mail Logs (Exim)<\/strong><\/td>\/var\/log\/exim_mainlog<\/code>\/var\/log\/exim_rejectlog<\/code>\/var\/log\/exim_paniclog<\/code><\/td>Logs for sent mail, rejected mail, and critical errors respectively.<\/td><\/tr>
FTP Logs (Pure-FTPd \/ ProFTPD)<\/strong><\/td>\/var\/log\/messages<\/code>\/var\/log\/xferlog<\/code><\/td>File transfer logs.<\/td><\/tr>
Apache (HTTP) Logs<\/strong><\/td>\/usr\/local\/apache\/logs\/access_log<\/code>\/usr\/local\/apache\/logs\/error_log<\/code><\/td>Logs all website hits and errors.<\/td><\/tr>
MySQL Logs<\/strong><\/td>\/var\/lib\/mysql\/hostname.err<\/code>\/var\/log\/mysqld.log<\/code><\/td>Logs database startup, shutdown, and errors.<\/td><\/tr>
cPHulk Brute Force Logs<\/strong><\/td>\/usr\/local\/cpanel\/logs\/cphulkd.log<\/code><\/td>Logs blocked IPs and login attempts.<\/td><\/tr>
CSF \/ LFD Firewall Logs (if installed)<\/strong><\/td>\/var\/log\/lfd.log<\/code><\/td>Logs login failures, blocks, and alerts.<\/td><\/tr>
Cron Logs<\/strong><\/td>\/var\/log\/cron<\/code><\/td>Logs all cron jobs run on the system.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\ud83d\udce6 Check Log Sizes<\/strong><\/h3>\n\n\n\n

You can use the following commands to check total or individual log sizes:<\/p>\n\n\n\n

\ud83d\udd39 Check size of all logs under \/usr\/local\/cpanel\/logs<\/code><\/h4>\n\n\n
du -sh \/usr\/local\/cpanel\/logs\/*\n<\/code><\/span><\/pre>\n\n\n
\ud83d\udd39 Check total size of cPanel logs directory<\/h4>\n\n\n
du -sh \/usr\/local\/cpanel\/logs\n<\/code><\/span><\/pre>\n\n\n
\ud83d\udd39 Check top 10 largest log files on the system<\/h4>\n\n\n
sudo du -ah \/var<\/span>\/log \/usr\/local\/cpanel\/logs | sort -rh | head -10<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\ud83d\udd39 Human-readable disk usage summary<\/h4>\n\n\n
df -h\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
\ud83e\uddf9 Optional: Clean or Rotate Logs<\/strong><\/h3>\n\n\n\n
If logs become large, you can rotate or clear them safely.<\/p>\n\n\n\n
Rotate logs (built-in system)<\/h4>\n\n\n
\/usr\/local\/cpanel\/scripts\/logrotate\n<\/code><\/span><\/pre>\n\n\n
Manually truncate a large log<\/h4>\n\n\n\n
(Example: clear Apache access log)<\/em><\/p>\n\n\n
> \/usr\/<\/span>local\/apache\/logs\/access_log\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
\ud83e\udde9 Tip: Watch Logs in Real-Time<\/strong><\/h3>\n\n\n\n
You can monitor specific log activity live:<\/p>\n\n\n
tail -f \/usr\/local\/cpanel\/logs\/error_log\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
In a Linux server running WHM\/cPanel, logs are stored in several key directories depending on the type of activity being logged.Here\u2019s a full breakdown of where to find them and… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-53891","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=53891"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53891\/revisions"}],"predecessor-version":[{"id":53892,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53891\/revisions\/53892"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=53891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=53891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=53891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}