cPanel User Login Logging?

Mark Coates

• August 08, 2019 04:36

Hi I was just wondering if there is a log somewhere or anyway of knowing which user's login to their cpanel account? By this i dont mean cpanel access like email or ftp i mean physically logging into cpanel itself either through my site or using the port 2083. Thanks :)

• 

  Muhammed Fasal

  • August 09, 2019 12:56

  Mark, Each cPanel account itself should have a hidden log file in its home directory there as '.lastlogin' to record the history successful logins. To get it, go to 'File Manager' interface and make the hidden files visible by going to the Settings tab from right top corner, and view the file named '.lastlogin' there. This file will log the IP address of the logged in visitor, date and time for reference. If you have the root level SSH access, then you can run below oneliner command to see the successful logins to the cPanel/WHM accounts there: grep "login=1&post_login=" /usr/local/cpanel/logs/access_log | awk '{print $1" : "$3" : "$4}'
  The above one liner could be improved a bit more, I wrote it just now and had no time to make the output even better.

  0
• 

  Mark Coates

  • August 09, 2019 13:27

  Thanks :)

  0
• 

  cPanelLauren

  • August 09, 2019 16:16

  Thanks @Muhammed Fasal for the awesome response and help!

  0
• 

  Muhammed Fasal

  • August 09, 2019 16:46

  Most welcome guys @Mark Coates @cPanelLauren ;)

  0
• 

  Ed Bergavera

  • January 14, 2022 00:39

  Mark, Each cPanel account itself should have a hidden log file in its home directory there as '.lastlogin' to record the history successful logins. To get it, go to 'File Manager' interface and make the hidden files visible by going to the Settings tab from right top corner, and view the file named '.lastlogin' there. This file will log the IP address of the logged in visitor, date and time for reference. If you have the root level SSH access, then you can run below oneliner command to see the successful logins to the cPanel/WHM accounts there: grep "login=1&post_login=" /usr/local/cpanel/logs/access_log | awk '{print $1" : "$3" : "$4}'
  The above one liner could be improved a bit more, I wrote it just now and had no time to make the output even better.

  
  The command really helps!

  0
• 

  cPanelAnthony

  • January 19, 2022 21:44

  Hello. I'm happy this post helped you!

  0

Please sign in to leave a comment.