How do I view Webmail access logs

Question

How do I view the Webmail access logs?

Answer

All activity in WHM, cPanel, and Webmail is logged to: /usr/local/cpanel/logs/access_log

Webmail traffic is on port 2096, and as such, a grep for 2096 will provide only the Webmail activity. For example, the following command returns the entries of the log that pertain to Webmail:

# grep ":2096/" /usr/local/cpanel/logs/access_log

Searching for Webmail activity for a specific email account is also possible. In this case, the "@" symbol will need to be URL encoded as "%40". For example, the following command will return the Webmail activity for the user@domain.com address:

# grep "user%40domain.com" /usr/local/cpanel/logs/access_log