Find who deleted email accounts

Benito

• January 18, 2021 15:40

Hello! Where i have to look who deleted several email accounts? A customer says he didn't do it and i want to give him some proof that someone with access to his cPanel or FTP account deleted the email addresses. Thanks

• 

  kodeslogic

  • January 19, 2021 15:42

  Check cPanel access logs #cat /usr/local/cpanel/logs/access_log | grep "delete_pop"
  

  0
• 

  Benito

  • January 19, 2021 16:37

  Check cPanel access logs #cat /usr/local/cpanel/logs/access_log | grep "delete_pop"
  

  
  Thanks! Very usefull, i think the accounts where deleted by FTP.

  0
• 

  cPRex Jurassic Moderator

  • January 19, 2021 19:53

  The cPanel access_log file would be the best place to see who logged in with cPanel services or used a cPanel tool to remove the account. If the work was done over FTP you may be able to get additional details from the /var/log/messages file on the system.

  0

Please sign in to leave a comment.