What does this entry in /usr/local/cpanel/logs/session_log mean

Question

What does the following entry in /usr/local/cpanel/logs/session_log mean in cPanel & WHM?

CONFIG_TEXT: [2025-06-25 00:32:54 +0300] info [cpaneld] 203.0.113.2 NEW username:AbCdEfGhIjKlMnOp 
address=203.0.113.2,app=cpaneld,creator=username,method=handle_form_login,path=form,possessed=1,possessor=reseller

Answer

The /usr/local/cpanel/logs/session_log file records new sessions, which are new logins that were accepted into the cPanel & WHM interfaces.

The following fields show who logged in, from where, and through which service:

• address: The IP address the new session was opened from.
• app: The service that opened the new session. In this example, cpaneld is the cPanel service.
• creator: The user the session is being opened for.
• possessed: Shows whether the new login was initiated from another account, such as a reseller account: 1 means it was, 0 means it was not.
• possessor: The account that logged in to the user's account. It appears when another account, such as a reseller, gains access to the user's account. The login was accepted using the possessor's own account authentication method.

To check whether someone other than the account owner logged in, look at possessed and possessor. In the example, possessed=1 and possessor=reseller means the account reseller logged in to the account username.