How to find when a cPanel account was terminate/deleted

Introduction

If you need to know when a specific account was terminated to help narrow down which backup dates you have available or any other reason you can find that information in the accounting log file. The /var/cpanel/accounting.log file contains records of cPanel account actions, such as creation, deletion, and suspension.

Procedure

1. Access the server's command line as the 'root' user via SSH or "Terminal" in WHM.
2. Use the grep command to find "REMOVE" actions for the account's username.

   [root@server ~]# grep cpusername /var/cpanel/accounting.log|grep REMOVE
   Wed Apr 26 13:33:53 2023:REMOVE:root:root:domain.tld:cpusername
   [root@server ~]#

   Please note that cpusername must be replaced by the username of the account in question.

Additional resources

The cPanel & WHM Log Files