How to check what IPs are changing MySQL user passwords using cPanel

Introduction

You may need to determine if there is access being made from multiple IPs into a cPanel account and making changes or need to know when the change to a MySQL password was made. These are stored in /usr/local/cpanel/logs/access_log

Procedure

In this example the username is "sleepy".

grep sleepy  /usr/local/cpanel/logs/access_log | grep sql/\changepasswd.html