Question
How can I find when an account package was modified to another plan?
Answer
Per our documentation regarding cPanel log files (The cPanel & WHM Log Files), the information regarding package modification may be found in the log files referenced below.
This file contains records of cPanel account actions, such as creation and deletion:
/var/cpanel/accounting.log
This file contains records of when a cPanel & WHM user accesses their account:
/usr/local/cpanel/logs/access_log