How do I view Webmail access logs

Introduction

From time to time, the need may arise to review the logs for Webmail. All activity in WHM, cPanel, and Webmail is logged to the following file.

/usr/local/cpanel/logs/access_log

Procedure

Webmail traffic is on port 2096, and as such, a grep for 2096 will provide only the webmail activity. For example, the following command returns the entries of the log that pertain to Webmail.

grep ":2096/" /usr/local/cpanel/logs/access_log

Searching for Webmail activity for a specific email account is also possible. In this case, the "@" symbol will need to be URL encoded as "%40". For example, the following command will return the Webmail activity for the user@domain.com address.

grep "user%40domain.com" /usr/local/cpanel/logs/access_log