How to check logs for IP addresses that accessed cPanel by date

Introduction

This article will cover how to check logs for ip addresses that accessed cpanel by date.

Procedure

To get a count of how many times an IP accessed the login by dates, you can use the following command:

awk '{ print $1, $6 }' /usr/local/cpanel/logs/login_log | uniq -c | sort -nr

This will provide an output that includes the date and the IPs that accessed cPanel sorted to unique IPs accessing on each date in reverse order so that the IP accessing cPanel login most frequently will be displayed at the top of the output.

You can also add the 8th field to awk to get the user name:

awk '{ print $1, $6 , $8 }' /usr/local/cpanel/logs/login_log | uniq -c | sort -nr| head