cPanel & WHM Log File Locations
In this guide, you'll find every log file path on cPanel & WHM. These paths apply to cPanel & WHM v118, cPanel & WHM v116, cPanel & WHM v114, cPanel & WHM v112, cPanel & WHM v110, cPanel & WHM v108, cPanel & WHM v106, cPanel & WHM v104, cPanel & WHM v102, cPanel & WHM v100, cPanel & WHM v98, cPanel & WHM v96, cPanel & WHM v94, and cPanel & WHM v92. All log locations below remain consistent across all 14 versions unless noted otherwise.
Hosting Panelyum / dnf6 services covered
Quick Reference
| Service | Primary Log Path | Category |
|---|---|---|
| cPanel/WHM Panel | /usr/local/cpanel/logs/error_log | Hosting Panel |
| Apache (cPanel EasyApache) | /var/log/apache2/error_log | Web Server |
| Exim (cPanel) | /var/log/exim_mainlog | |
| MySQL/MariaDB (cPanel) | /var/log/mysqld.log | Database |
| PHP (cPanel MultiPHP) | /usr/local/cpanel/logs/php-fpm/error.log | Runtime |
| Webmail (Roundcube) | /var/cpanel/roundcube/log/ | Hosting Panel |
cPanel/WHM Panel
Hosting PanelLog Files
| Path | Description |
|---|---|
/usr/local/cpanel/logs/error_log | Main cPanel error log — system errors and fatal conditions |
/usr/local/cpanel/logs/access_log | cPanel/WHM access log in Common Log Format |
/usr/local/cpanel/logs/login_log | Login attempts with success/failure status for cPanel, WHM, and Webmail |
/usr/local/cpanel/logs/session_log | User activity logs during active sessions |
/usr/local/cpanel/logs/panic_log | Severe/fatal errors — should remain empty on a healthy server |
/usr/local/cpanel/logs/api_log | All cPanel API1, API2, and UAPI calls |
/usr/local/cpanel/logs/cphulkd.log | cPHulk brute force protection activity log |
/usr/local/cpanel/logs/cphulkd_errors.log | cPHulk daemon error log |
/var/cpanel/accounting.log | Account actions — creation, deletion, suspension, unsuspension |
/var/log/chkservd.log | Service monitor (chkservd) — tracks service health checks |
/usr/local/cpanel/logs/stats_log | Bandwidth statistics processing log for all accounts |
/usr/local/cpanel/logs/license_log | License update and verification log |
/usr/local/cpanel/logs/queueprocd.log | Task queue processing daemon log |
/usr/local/cpanel/logs/cpbackup/ | Backup operation logs directory |
/usr/local/cpanel/logs/cpbackup_transporter.log | Backup transport and remote destination log |
Configuration Files
| Path | Description |
|---|---|
/var/cpanel/cpanel.config | Main cPanel configuration |
/etc/cpupdate.conf | cPanel update configuration |
Common Commands
View cPanel error log
sudo tail -100 /usr/local/cpanel/logs/error_logFollow cPanel error log
sudo tail -f /usr/local/cpanel/logs/error_logView login attempts
sudo tail -50 /usr/local/cpanel/logs/login_logView brute force log
sudo tail -50 /usr/local/cpanel/logs/cphulkd.logView account actions
sudo tail -50 /var/cpanel/accounting.logView service monitor log
sudo tail -100 /var/log/chkservd.logView backup log
sudo ls -lt /usr/local/cpanel/logs/cpbackup/ | head -5Check cPanel version
sudo /usr/local/cpanel/cpanel -VInstall
Pre-installed with cPanel licenseApache (cPanel EasyApache)
Web ServerLog Files
| Path | Description |
|---|---|
/var/log/apache2/error_log | Main Apache error log — webserver and CGI application errors |
/var/log/apache2/access_log | Main Apache access log |
/var/log/apache2/suexec_log | suEXEC audit log — tracks CGI script execution under user accounts |
/var/log/apache2/suphp_log | suPHP module audit log |
/var/log/apache2/modsec_audit.log | ModSecurity audit log — WAF rule matches and blocks |
/etc/apache2/logs/domlogs/ | Per-domain access logs directory |
/etc/apache2/logs/domlogs/example.com | Domain-specific HTTP access log |
/etc/apache2/logs/domlogs/example.com-ssl_log | Domain-specific HTTPS access log |
/etc/apache2/logs/domlogs/ftpxferlog | FTP transfer log |
/usr/local/cpanel/logs/safeapacherestart_log | Apache restart history — logs every graceful and hard restart |
Configuration Files
| Path | Description |
|---|---|
/etc/apache2/conf/httpd.conf | Main Apache configuration (managed by cPanel — do not edit directly) |
/etc/apache2/conf.d/includes/ | User-editable Apache includes (survive rebuilds) |
/etc/apache2/conf.d/userdata/ | Per-user and per-domain Apache configuration |
Common Commands
View Apache error log
sudo tail -100 /var/log/apache2/error_logFollow Apache error log
sudo tail -f /var/log/apache2/error_logView domain-specific log
sudo tail -100 /etc/apache2/logs/domlogs/example.comList all domain logs
ls -la /etc/apache2/logs/domlogs/View ModSecurity log
sudo tail -100 /var/log/apache2/modsec_audit.logRebuild Apache config
sudo /scripts/rebuildhttpdconf && sudo systemctl restart httpdCheck Apache config syntax
sudo apachectl configtestInstall
Managed by cPanel EasyApache 4 — do not install separatelyExim (cPanel)
MailLog Files
| Path | Description |
|---|---|
/var/log/exim_mainlog | All email transactions — deliveries, bounces, deferrals, rejections |
/var/log/exim_rejectlog | Messages rejected via ACL rules with rejection reasons |
/var/log/exim_paniclog | Exim fatal errors — should remain empty on a healthy server |
/var/log/maillog | System mail log — Dovecot IMAP/POP3 and SpamAssassin activity |
Configuration Files
| Path | Description |
|---|---|
/etc/exim.conf | Main Exim configuration (managed by cPanel — do not edit directly) |
/etc/exim.conf.local | Local customizations — survives cPanel updates |
Common Commands
View recent email transactions
sudo tail -200 /var/log/exim_mainlogFollow email log
sudo tail -f /var/log/exim_mainlogView rejected emails
sudo tail -100 /var/log/exim_rejectlogSearch for email by address
sudo grep '[email protected]' /var/log/exim_mainlogView mail queue
sudo exim -bp | head -50Count messages in queue
sudo exim -bpcView Dovecot/SpamAssassin log
sudo tail -100 /var/log/maillogInstall
Managed by cPanel — do not install separatelyMySQL/MariaDB (cPanel)
DatabaseLog Files
| Path | Description |
|---|---|
/var/log/mysqld.log | MySQL/MariaDB error log (MySQL 5.7+, MariaDB 10.3+) |
/var/lib/mysql/${hostname}.err | MySQL error log on older versions (named after the server hostname) |
/var/cpanel/logs/mysql_upgrade.log | MySQL/MariaDB upgrade process log |
Configuration Files
| Path | Description |
|---|---|
/etc/my.cnf | Main MySQL/MariaDB configuration |
Common Commands
Find MySQL error log path
mysql -e "SHOW VARIABLES LIKE 'log_error';"View MySQL error log (new path)
sudo tail -100 /var/log/mysqld.logView MySQL error log (hostname path)
sudo tail -100 /var/lib/mysql/$(hostname).errFollow MySQL error log
sudo tail -f /var/log/mysqld.logCheck MySQL status
sudo systemctl status mysqldInstall
Managed by cPanel — do not install separatelyPHP (cPanel MultiPHP)
RuntimeLog Files
| Path | Description |
|---|---|
/usr/local/cpanel/logs/php-fpm/error.log | Main PHP-FPM implementation error log |
/opt/cpanel/ea-php83/root/var/log/php-fpm/error.log | PHP-FPM error log for EA PHP 8.3 |
/var/cpanel/php-fpm/USER/logs/error.log | Per-user PHP-FPM error log |
/var/cpanel/php-fpm/USER/logs/slow.log | Per-user slow script log — scripts with unusually long execution |
/home/USER/logs/.php.error.log | Per-user internal PHP execution errors |
/var/log/apache2/error_log | PHP errors may also appear in the Apache error log |
Configuration Files
| Path | Description |
|---|---|
/opt/cpanel/ea-php83/root/etc/php-fpm.conf | PHP-FPM configuration for EA PHP 8.3 |
/opt/cpanel/ea-php83/root/etc/php-fpm.d/ | PHP-FPM pool configurations |
/opt/cpanel/ea-php83/root/etc/php.ini | PHP.ini for EA PHP 8.3 |
Common Commands
View main PHP-FPM error log
sudo tail -100 /usr/local/cpanel/logs/php-fpm/error.logView EA PHP 8.3 FPM log
sudo tail -100 /opt/cpanel/ea-php83/root/var/log/php-fpm/error.logFollow PHP-FPM log
sudo tail -f /usr/local/cpanel/logs/php-fpm/error.logList installed EA PHP versions
ls /opt/cpanel/ea-php*/Check PHP-FPM status
sudo systemctl status ea-php83-php-fpmView domain's PHP version
sudo whmapi1 php_get_domain_handler domain=example.comView per-user slow log
sudo tail -50 /var/cpanel/php-fpm/USERNAME/logs/slow.logInstall
Managed by cPanel EasyApache 4 — install via WHM > EasyApache 4Webmail (Roundcube)
Hosting PanelLog Files
| Path | Description |
|---|---|
/var/cpanel/roundcube/log/ | Roundcube webmail logs (MySQL backend) |
/home/USER/logs/roundcube/ | Roundcube webmail logs (SQLite backend, per-user) |
Configuration Files
| Path | Description |
|---|---|
/var/cpanel/roundcube/config/ | Roundcube configuration directory |
Common Commands
View Roundcube logs
sudo ls -lt /var/cpanel/roundcube/log/Install
Included with cPanelTroubleshooting
Permission denied viewing logs
Most log files require root access. Use sudo before your command, or add your user to the adm group: sudo usermod -aG adm $USER
Log file is empty
Verify the service is running with systemctl status service-name. Check the service config to confirm logging is enabled and the log path is correct.
How to enable debug logging
For Nginx, set error_log /var/log/nginx/error.log debug; in nginx.conf. For Apache, set LogLevel debug in httpd.conf. For PHP-FPM, set log_level = debug in pool config. Remember to revert after debugging.
Log rotation not working
Test with sudo logrotate -d /etc/logrotate.d/nginx (dry run) or sudo logrotate -f /etc/logrotate.d/nginx (force). Check that the logrotate cron job exists in /etc/cron.daily/logrotate.
Covered Versions
The log file paths on this page apply to all of the following versions.
cPanel & WHM v118
EOL:
cPanel & WHM v116
EOL:
cPanel & WHM v114
EOL:
cPanel & WHM v112
EOL:
cPanel & WHM v110
EOL:
cPanel & WHM v108
EOL:
cPanel & WHM v106
EOL:
cPanel & WHM v104
EOL:
cPanel & WHM v102
EOL:
cPanel & WHM v100
EOL:
cPanel & WHM v98
EOL:
cPanel & WHM v96
EOL:
cPanel & WHM v94
EOL:
cPanel & WHM v92
EOL:
Related Versions
PleskPlesk Obsidian 18.0.70, Plesk Obsidian 18.0.60, Plesk Obsidian 18.0.50, Plesk Obsidian 18.0.40, Plesk Obsidian 18.0.30, Plesk Obsidian 18.0.20, Plesk Onyx 17.8, Plesk Onyx 17.5, Plesk Onyx 17.0RHEL FamilyAlmaLinux 9, AlmaLinux 10, Rocky Linux 9, Amazon Linux 2023, CloudLinux 9, Rocky Linux 10, Fedora 43, Fedora 42, Fedora 41, Fedora 40