Where are the cPanel log in and access logs?

Question

Where can I find the cPanel log in history and access logs? 

Answer

cPanel log in history is stored in /usr/local/cpanel/logs/login_log.

Access logs are located at /usr/local/cpanel/logs/access_log. If you are looking for rotated logs, they are at /usr/local/cpanel/logs/archive/*-MM-YYYY where YYYYrepresents the year, and MM the month.

There are also the session logs in /usr/local/cpanel/logs/session_log  which can be used to determine which IPs accessed the account.

As an example

root@server [~] # grep cptest /usr/local/cpanel/logs/session_log|grep NEW |cut -d " " -f1-3,5-6,8 | column -t
[2022-09-17  15:05:03  -0500]  [whostmgrd]  10.3.9.1    cptest:yF1juwFpuPgRQ5Pv
[2022-09-17  15:05:04  -0500]  [cpaneld]    10.3.9.1    cptest:MPZD7hUwAgxhrSWd
[2022-09-17  15:05:17  -0500]  [cpaneld]    10.3.9.1    cptest:4MtdtXnjJlFcH57X
[2022-09-27  13:43:06  +0000]  [whostmgrd]  10.3.9.119  cptest:UrPDlnlcekVO5bJW
[2022-09-27  13:43:07  +0000]  [cpaneld]    10.3.9.119  cptest:xMawK9faD7Wwr5R