Introduction
If you find yourself needing to know when a specific account was terminated to help narrow down which backup dates you have available or any other reason you can find that information in the accounting log file.
Procedure
The accounting log can be found at the following location:
/var/cpanel/accounting.log
The entries for accounts that have been terminated or delete will contain the string REMOVE.
The first few columns contain the time and date the action took place. Next you will see what action was taken. In this case REMOVE. Then you will see the owner of the account, the primary domain name, and lastly the username.
If you want to see only accounts that were removed use the following:
# grep REMOVE /var/cpanel/accounting.log
Fri Apr 09 11:07:41 2021:REMOVE:root:root:DOMAIN.TLD:USERNAME
Fri Apr 16 16:11:25 2021:REMOVE:root:root:DOMAIN2.TLD:USERNAME2
If you want to see the actions for a specific username or domain name you would use one of the following instead.
# grep USERNAME /var/cpanel/accounting.log
Fri Apr 09 11:07:41 2021:REMOVE:root:root:DOMAIN.TLD:USERNAME
Fri Apr 16 16:11:25 2021:REMOVE:root:root:DOMAIN2.TLD:USERNAME2
# grep "DOMAIN.TLD" /var/cpanel/accounting.log
Fri Apr 09 11:07:41 2021:REMOVE:root:root:DOMAIN.TLD:USERNAME
Fri Apr 16 16:11:25 2021:REMOVE:root:root:DOMAIN2.TLD:USERNAME2