Introduction
From time to time, the need may arise to review the logs for Webmail. All activity in WHM, cPanel, and Webmail is logged to the following file.
/usr/local/cpanel/logs/access_log
Procedure
Webmail traffic is on port 2096, and as such, a grep for 2096 will provide only the webmail activity. For example, the following command returns the entries of the log that pertain to Webmail.
grep ":2096/" /usr/local/cpanel/logs/access_log
Searching for Webmail activity for a specific email account is also possible. In this case, the "@" symbol will need to be URL encoded as "%40". For example, the following command will return the Webmail activity for the user@domain.com address.
grep "user%40domain.com" /usr/local/cpanel/logs/access_log