Skip to main content

How to find details on the deletion of an account?

Alex Jankowiak
  • Updated

Help! An account is gone and I don't know where! I need to know how and why it was deleted.

Procedure

First, check if you have backups enabled

You can always restore an account backup if a cPanel account or an email account goes missing, but you might want to review logs and do your analysis first.

What can be done when files go missing from a cPanel account?

Next, review some logs

There are some relevant logs that you should review, however this isn't foolproof.

  • /usr/local/cpanel/logs/access_log
    • You'll want to look for these API calls
      • removeacct - for removed cPanel accounts
      • delete_pop - for removed email accounts
  • /home/cpanelusername/.bash_history and /root/.bash_history
    • Look for things like: rm, deluser
  • /var/log/messages
    • Look for FTP logs
  • /var/log/secure
    • This will contain SSH login information
  • /home/cpanelusername/.lastlogin
    • This contains the IP addresses of recent logins for the user

For email, check for site level compromises

WordPress and other CMS's are often targeted for their widespread install-base. Results of automated attacks can result in email accounts seemingly disappearing.

Suddenly missing email accounts and not able to recreate them

Related articles