Diagnosis of a server downtime under a WHM environment

Hi, We are currently experiencing downtimes with one of our WHM instance. We have around 40 WordPress websites and each have their own cPanel accounts. We suspect that some of our websites are being bomb by bots. The big majority of the websites uses well knowns plugins and all have WordFence installed. I'm a bit confused as to where I should start looking when diagnonising server downtime under a WHM environment. Which logs files should I watch? Is there a log file that I can tail in real time? If I believe the server went down due to bots targeting a specific websites under a specific cPanel account at a specific hour, which log file should I check? Is there a tool or a way for me to know how many times an IP address hits our server ? I'm a bit lost and would like clues on how to properly diagnosis those sort of thing. Any help would be greatly appreciated. Thanks a lot!