Introduction
You may need to determine if there is access being made from multiple IPs into a cPanel account and making changes or need to know when the change to a MySQL password was made. These are stored in /usr/local/cpanel/logs/access_log
Procedure
In this example the username is "sleepy".
grep sleepy /usr/local/cpanel/logs/access_log | grep sql/\changepasswd.html