If you need to know when a specific account was terminated to help narrow down which backup dates you have available or any other reason you can find that information in the accounting log file. The
/var/cpanel/accounting.log file contains records of cPanel account actions, such as creation, deletion, and suspension.
- Access the server's command line as the 'root' user via SSH or "Terminal" in WHM.
- Use the
grepcommand to find "REMOVE" actions for the account's username.
[root@server ~]# grep cpusername /var/cpanel/accounting.log|grep REMOVEPlease note that cpusername must be replaced by the username of the account in question.
Wed Apr 26 13:33:53 2023:REMOVE:root:root:domain.tld:cpusername