Is there a log for when an email account was added or deleted? – cPanel

Question

Is there a log for when an email account was added or deleted?

Answer

There is no direct log for when an email account is created or removed. However, you can review the cPanel access log for the relevant cPanel interface calls which may provide further information.

Note: If an email account was created using the API, it will not be logged in the cPanel access log.

Email Account Creation

Entries for an email account's creation will be logged like the following in the cPanel Access Log:

CONFIG_TEXT: 203.0.113.2 - cpuser [07/08/2026:10:00:00 -0000] POST /cpsess1234567890/execute/Email/add_pop

Note: This information contains the IP, the date in UTC, and the cPanel user the action occurred on. However, the log does not specify what email account was added.

Login as the root user via SSH, or the Terminal in WHM.
Run the following command to search for the add_pop request in the cPanel Access Log.
# grep -a add_pop /usr/local/cpanel/logs/access_log* | grep -a POST

You can search the archived logs (if they are available) by running this command:

# zgrep -a add_pop /usr/local/cpanel/logs/archive/access_log* | zgrep -a POST

Email Account Removal

Entries for an email account's removal will be logged like the following in the cPanel Access Log:

CONFIG_TEXT: 203.0.113.2 - cpuser [07/08/2026:10:00:00 -0000] POST /cpsess1234567890/execute/Email/delete_pop

Note: This information contains the IP, the date in UTC, and the cPanel user the action occurred on. However, the log does not specify what email account was removed.

Login as the root user via SSH, or the Terminal in WHM.
Run the following command to search for the delete_pop request in the cPanel Access Log.
# grep -a delete_pop /usr/local/cpanel/logs/access_log | grep -a POST

You can search the archived logs (if they are available) by running this command:

# zgrep -a delete_pop /usr/local/cpanel/logs/archive/access_log* | zgrep -a POST

Question

Answer

Related articles