Question
Where can I find the cPanel log in history and access logs?
Answer
cPanel log in history is stored in /usr/local/cpanel/logs/login_log.
Access logs are located at /usr/local/cpanel/logs/access_log. If you are looking for rotated logs, they are at /usr/local/cpanel/logs/archive/*-MM-YYYY where YYYYrepresents the year, and MM the month.
There are also the session logs in /usr/local/cpanel/logs/session_log which can be used to determine which IPs accessed the account.
As an example
root@server [~] # grep cptest /usr/local/cpanel/logs/session_log|grep NEW |cut -d " " -f1-3,5-6,8 | column -t
[2022-09-17 15:05:03 -0500] [whostmgrd] 10.3.9.1 cptest:yF1juwFpuPgRQ5Pv
[2022-09-17 15:05:04 -0500] [cpaneld] 10.3.9.1 cptest:MPZD7hUwAgxhrSWd
[2022-09-17 15:05:17 -0500] [cpaneld] 10.3.9.1 cptest:4MtdtXnjJlFcH57X
[2022-09-27 13:43:06 +0000] [whostmgrd] 10.3.9.119 cptest:UrPDlnlcekVO5bJW
[2022-09-27 13:43:07 +0000] [cpaneld] 10.3.9.119 cptest:xMawK9faD7Wwr5R