Where are the CSF/LFD logs?

Warning: Please note that Way to the Web Ltd. (the company behind ConfigServer) closed permanently on August 31, 2025. However, their free scripts will remain available under the GPLv3 license.

cPanel will provide its own fork of CSF starting Feb 25th, 2026

Question

Where are the CSF/LFD logs?

Answer

The log files that CSF and LFD use are the following:

/var/log/lfd.log

• The log contains any failed login attempts, as well as IP addresses that have been blocked by CSF.

/etc/csf/csf.deny

• Contains lists of IP addresses that have been blocked. For each entry, it shows the date the IP address was blocked and the reason.

/etc/csf/csf.allow

• Contains lists of IP addresses that have been whitelisted.

Note: CSF is a third-party product that cPanel does not directly support.