Where are the cPanel log in and access logs?

Question

Where can I find the cPanel log in history and access logs? 

Answer

cPanel login history are located in /usr/local/cpanel/logs/login_log.

Access logs are located in /usr/local/cpanel/logs/access_log. 

Rotated logs are located in /usr/local/cpanel/logs/archive/*-MM-YYYY where YYYY is the year, and MM the month.

Session logs are located in /usr/local/cpanel/logs/session_log  which can be used to determine which IPs accessed the account.

As an example:

# root@server [~] # grep cptest /usr/local/cpanel/logs/session_log|grep NEW |cut -d " " -f1-3,5-6,8 | column -t
[2025-03-17 15:05:03 -0500] [whostmgrd] 10.3.9.1 cptest:yF1juwFpuPgRQ5Pv
[2025-03-17 15:05:04 -0500] [cpaneld] 10.3.9.1 cptest:MPZD7hUwAgxhrSWd
[2025-03-17 15:05:17 -0500] [cpaneld] 10.3.9.1 cptest:4MtdtXnjJlFcH57X
[2025-03-27 13:43:06 +0000] [whostmgrd] 10.3.9.119 cptest:UrPDlnlcekVO5bJW
[2025-03-27 13:43:07 +0000] [cpaneld] 10.3.9.119 cptest:xMawK9faD7Wwr5R