From time to time, the need may arise to review the logs for Webmail. All activity in WHM, cPanel, and Webmail is logged to the following file.
Webmail traffic is on port 2096, and as such, a grep for 2096 will provide only the webmail activity. For example, the following command returns the entries of the log that pertain to Webmail.
grep ":2096/" /usr/local/cpanel/logs/access_log
Searching for Webmail activity for a specific email account is also possible. In this case, the "@" symbol will need to be URL encoded as "%40". For example, the following command will return the Webmail activity for the email@example.com address.
grep "user%40domain.com" /usr/local/cpanel/logs/access_log