Where are the cPanel log in and access logs?

Question

Where can I find the cPanel log in history and access logs? 

Answer

cPanel log in history is stored in /usr/local/cpanel/logs/login_log.

Access logs are located at /usr/local/cpanel/logs/access_log. If you are looking for rotated logs, they are at /usr/local/cpanel/logs/archive/*-MM-YYYY where YYYYrepresents the year, and MM the month.

There are also the session logs in /usr/local/cpanel/logs/session_log  which can be used to determine which IPs accessed the account.

As an example

root@server [~] # grep cptest /usr/local/cpanel/logs/session_log|grep NEW |cut -d " " -f1-3,5-6,8 | column -t
[2022-09-17 15:05:03 -0500] [whostmgrd] 10.3.9.1 cptest:yF1juwFpuPgRQ5Pv
[2022-09-17 15:05:04 -0500] [cpaneld] 10.3.9.1 cptest:MPZD7hUwAgxhrSWd
[2022-09-17 15:05:17 -0500] [cpaneld] 10.3.9.1 cptest:4MtdtXnjJlFcH57X
[2022-09-27 13:43:06 +0000] [whostmgrd] 10.3.9.119 cptest:UrPDlnlcekVO5bJW
[2022-09-27 13:43:07 +0000] [cpaneld] 10.3.9.119 cptest:xMawK9faD7Wwr5R