Apache log, Mysql, FTP, Exim, cPanel file location on a Linux / cPanel Server
Location of common log files on a cPanel WHM server
Log files are very helpful to troubleshoot errors on your Linux server. Logs are the first place you should check if you face any issues on the server/website. Example : you must check the Apache logs if you site is showing errors, check website access logs if there is any attack etc. On a linux server the log files are saved by default in the /var/log directory.
1. Log into your Linux server via SSH as ‘root’
2. Go to /var/log directory using cd command
cd /var/log
3. Type ‘ls -l’ command to list all log files in the /var/log directory
[root@server ~]# cd /var/log/
[root@server log]# ll
============================================================
drwx–x–x 4 root root 4096 Aug 27 12:01 apache2
drwx—— 2 root root 4096 Aug 27 11:39 audit
-rw——- 1 root root 0 Aug 27 11:39 boot.log
-rw——- 1 root utmp 428544 Aug 29 04:08 btmp
-rw——- 1 root root 869308 Sep 1 07:19 chkservd.log
-rw-r–r– 1 root root 136061 Sep 1 07:19 cloud-init.log
-rw-r–r– 1 root root 5321 Sep 1 07:19 cloud-init-output.log
-rw-r–r– 1 root root 867914 Aug 27 12:09 cpanel-install.log
-rw-r–r– 1 root root 1634 Aug 27 11:44 cpanel-install.log.1503834259
-rw——- 1 root root 142093 Sep 1 07:20 cron
drwx—— 5 root root 4096 Sep 1 07:20 dcpumon
-rw-r–r– 1 root root 22740 Sep 1 07:19 dmesg
-rw-r–r– 1 root root 22652 Aug 27 11:39 dmesg.old
-rw-r–r– 1 root root 207174 Aug 27 11:45 dracut.log
-rw-r—– 1 mailnull mail 277876 Sep 1 07:19 exim_mainlog
-rw-r—– 1 mailnull mail 0 Aug 27 11:50 exim_paniclog
-rw-r—– 1 mailnull mail 308 Aug 28 12:37 exim_rejectlog
-rw-r–r– 1 root root 146292 Sep 1 07:21 lastlog
-rw——- 1 root root 2391052 Sep 1 07:21 maillog
-rw——- 1 root root 537117 Sep 1 07:21 messages
drwxr-xr-x 2 ntp ntp 4096 Apr 19 22:27 ntpstats
-rw——- 1 root root 35404 Aug 27 13:01 quota_enable.log
drwxr-xr-x 2 root root 4096 Sep 1 07:19 sa
-rw——- 1 root root 407039 Sep 1 07:21 secure
-rw——- 1 root root 0 Aug 13 02:16 spooler
-rw——- 1 root root 0 Aug 13 02:16 tallylog
-rw-rw-r– 1 root utmp 13056 Sep 1 07:21 wtmp
-rw-r–r– 1 root root 3 Aug 29 01:55 xferlog.offset
-rw-r–r– 1 root root 1 Sep 1 07:19 xferlog.offsetftpsep
-rw——- 1 root root 18613 Aug 27 12:01 yum.log
============================================================
Default log file location of the common services like Apache, FTP, SQL etc is given below.
How to view log files on Linux server
You can use cat, head, tail, grep, more, less, zcat, zgrep etc command to view the content of error log file. Few examples are given below.
Example :
cat /var/log/messages # Show the whole content of /var/log/messages file
You can filter specific keywords from the above log file using ‘grep’ command
cat /var/log/messages | grep -i named # print all lines containing named keyword.
less /var/log/messages
more /var/log/messages
tail -f /var/log/messages
tail -n 100 /var/log/messages # view last 100 line of /var/log/messages file
head -n 100 /var/log/messages # view first 100 line of /var/log/messages file
zcat /var/log/messages.1504251301.gz # to view the content of gunzip file
zgrep “named” /var/log/messages.1504251301.gz # to grep ‘named’ keyword in messages.1504251301.gz file
General Logs
/var/log/messages file contain general system logs. This log file contains logs related to kernel, FTP (pure-ftpd, proftpd), named, yum, ssh etc.
Apache log file location on a cPanel WHM Server
Apache Error Logs
Apache is the most widely used open source web server on linux servers. On cPanel Servers the apache log files are stored in the /usr/local/apache/logs directory. Dedicated and VPS hosting customers can view the contents of this error log file. Shared hosting customers do not have access to error_log file so they must contact the web hosting provider if they face any issues on the website. Log into your linux/cPanel server via SSH as ‘root’ and type the below command to view the last 10 lines of apache error_log.
tail -n 10 /usr/local/apache/logs/error_log
Tail the apache error log in the server backend and refresh the website in the browser to see the exact error.
Apache error log file location on cPanel servers : /usr/local/apache/logs/error_log
Apache error log file location on CentOS / RedHat / Fedora Servers : /etc/httpd/logs/error_log
Apache error log file location on Debian / Ubuntu Servers : /var/log/apache2/error.log
Apache error log location on a Plesk Server : /var/log/httpd/error_log
Apache Access logs
Apache Access log file Location on a cPanel Server : /usr/local/apache/logs/access_log
Apache Access log file location on Redhat / CentOS / Fedora Server : /var/log/httpd/access_log
Apache Access log file location on Debian / Ubuntu Servers : /var/log/apache2/access.log
Website errors and other logs related to apache are saved in this error_log file. On non-cpanel servers the log file is in a different location (/etc/httpd/logs/error_log)
Apache domlogs file: /usr/local/apache/domlogs/domain.com
Apache domlogs contain list of all IP addresses that accessed your site (IP address of visitors). You can also check the access log of your website here : /home/username/access-logs/domain.com
Apache suPHP audit log : /usr/local/apache/logs/suphp_log
mySQL Error log file Location on a cPanel WHM Server
MySQL log files are saved in the file /var/lib/mysql/Serverhostname.err
“Serverhostname” should be replaced with the actual server hostname.
Run the below command to check the MySQL slow query log file location on your server. Usually slow query logs are saved in /var/lib/mysql/
mysqladmin variables | grep -i slow_query_log_file
| slow_query_log_file | /var/lib/mysql/root-slow.log
On the above server slow query logs are saved in /var/lib/mysql/root-slow.log
FTP (ProFTPD & pure-FTPD) log file location on cPanel/WHM Server
FTP error and access logs on a cPanel Server are saved in the /var/log directory
/var/log/messages
OR
/var/log/xferlog
OR
/usr/local/apache/domlogs/ftpxferlog
cPanel Account Creation and Account Deletion logs
Account Creation, Account Deletion logs are saved in /var/cpanel/accounting.log on cPanel servers.
The below command will show all deleted cPanel account and when it was deleted.
root@server [~]# grep REMOVE /var/cpanel/accounting.log
Sun Nov 6 09:50:58 2011:REMOVE:admin:root:example.com:damien
The below command will show the creation date of all the accounts.
root@server [~]# grep CREATE /var/cpanel/accounting.log
Wed Oct 19 00:36:57 2011:CREATE:root:root:example.com:192.168.2.5:damien
cPanel Webmail log file location
On cPanel servers webmail logs are saved in /var/cPanel directory
Horde webmail logs directory : /var/cpanel/horde/log
SquirrelMail webmail log file directory : /var/cpanel/squirrelmail
Roundcube webmail log file directory : /var/cpanel/roundcube/log
SSH log file location
SSH log file contain successful and failed SSH login attempts. SSH logins and failures are saved in the below file.
SSH log file Location on Redhat and CentOS Servers : /var/log/secure
Example :
grep -i accepted /var/log/secure : This will shows all login attempts that were successful and the IP address from which they logged in.
SSH authentication log on Ubuntu / Debian servers : /var/log/auth.log
Yum log file location
Yum log file location on Linux / cPanel Servers : var/log/yum.log
To filter list of all Installed packages in yum log : cat /var/log/yum.log | grep -i installed
To filter list of all updated packages in yum log : cat /var/log/yum.log | grep -i Updated
To find list of packages uninstalled / Removed : cat /var/log/yum.log | grep -i Erased
Exim Mail Logs on a cPanel Server
/var/log/exim_mainlog : This log contains details of all incoming and outgoing emails from the server. You must check this log if you face any issues while sending or receiving any emails.
/var/log/exim_rejectlog : This logs contains emails that are rejected due to ACLs
/var/log/exim_paniclog : All errors related to exim service are saved in this log file.
/var/log/maillog : All IMAP/POP login details are saved in this log file (Courier, dovecot log file)
/usr/local/cpanel/3rdparty/mailmain/logs/ : Logs related to mailing lists are saved in this directory.
Cron Log file Location
Logs related to scheduled cron jobs are saved in /var/log/cron file. This this log file to check whether the scheduled cron job is running fine.
cPanel log files
On cPanel servers log files are saved in below directories :
/usr/local/cpanel/logs
/var/cpanel
/var/log
/usr/local/apache/logs
1. Log into your Linux server via SSH as ‘root’
2. Go to /var/log directory using cd command
cd /var/log
3. Type ‘ls -l’ command to list all log files in the /var/log directory
[root@server ~]# cd /var/log/
[root@server log]# ll
============================================================
drwx–x–x 4 root root 4096 Aug 27 12:01 apache2
drwx—— 2 root root 4096 Aug 27 11:39 audit
-rw——- 1 root root 0 Aug 27 11:39 boot.log
-rw——- 1 root utmp 428544 Aug 29 04:08 btmp
-rw——- 1 root root 869308 Sep 1 07:19 chkservd.log
-rw-r–r– 1 root root 136061 Sep 1 07:19 cloud-init.log
-rw-r–r– 1 root root 5321 Sep 1 07:19 cloud-init-output.log
-rw-r–r– 1 root root 867914 Aug 27 12:09 cpanel-install.log
-rw-r–r– 1 root root 1634 Aug 27 11:44 cpanel-install.log.1503834259
-rw——- 1 root root 142093 Sep 1 07:20 cron
drwx—— 5 root root 4096 Sep 1 07:20 dcpumon
-rw-r–r– 1 root root 22740 Sep 1 07:19 dmesg
-rw-r–r– 1 root root 22652 Aug 27 11:39 dmesg.old
-rw-r–r– 1 root root 207174 Aug 27 11:45 dracut.log
-rw-r—– 1 mailnull mail 277876 Sep 1 07:19 exim_mainlog
-rw-r—– 1 mailnull mail 0 Aug 27 11:50 exim_paniclog
-rw-r—– 1 mailnull mail 308 Aug 28 12:37 exim_rejectlog
-rw-r–r– 1 root root 146292 Sep 1 07:21 lastlog
-rw——- 1 root root 2391052 Sep 1 07:21 maillog
-rw——- 1 root root 537117 Sep 1 07:21 messages
drwxr-xr-x 2 ntp ntp 4096 Apr 19 22:27 ntpstats
-rw——- 1 root root 35404 Aug 27 13:01 quota_enable.log
drwxr-xr-x 2 root root 4096 Sep 1 07:19 sa
-rw——- 1 root root 407039 Sep 1 07:21 secure
-rw——- 1 root root 0 Aug 13 02:16 spooler
-rw——- 1 root root 0 Aug 13 02:16 tallylog
-rw-rw-r– 1 root utmp 13056 Sep 1 07:21 wtmp
-rw-r–r– 1 root root 3 Aug 29 01:55 xferlog.offset
-rw-r–r– 1 root root 1 Sep 1 07:19 xferlog.offsetftpsep
-rw——- 1 root root 18613 Aug 27 12:01 yum.log
============================================================
Default log file location of the common services like Apache, FTP, SQL etc is given below.
How to view log files on Linux server
You can use cat, head, tail, grep, more, less, zcat, zgrep etc command to view the content of error log file. Few examples are given below.
Example :
cat /var/log/messages # Show the whole content of /var/log/messages file
You can filter specific keywords from the above log file using ‘grep’ command
cat /var/log/messages | grep -i named # print all lines containing named keyword.
less /var/log/messages
more /var/log/messages
tail -f /var/log/messages
tail -n 100 /var/log/messages # view last 100 line of /var/log/messages file
head -n 100 /var/log/messages # view first 100 line of /var/log/messages file
zcat /var/log/messages.1504251301.gz # to view the content of gunzip file
zgrep “named” /var/log/messages.1504251301.gz # to grep ‘named’ keyword in messages.1504251301.gz file
General Logs
/var/log/messages file contain general system logs. This log file contains logs related to kernel, FTP (pure-ftpd, proftpd), named, yum, ssh etc.
Apache log file location on a cPanel WHM Server
Apache Error Logs
Apache is the most widely used open source web server on linux servers. On cPanel Servers the apache log files are stored in the /usr/local/apache/logs directory. Dedicated and VPS hosting customers can view the contents of this error log file. Shared hosting customers do not have access to error_log file so they must contact the web hosting provider if they face any issues on the website. Log into your linux/cPanel server via SSH as ‘root’ and type the below command to view the last 10 lines of apache error_log.
tail -n 10 /usr/local/apache/logs/error_log
Tail the apache error log in the server backend and refresh the website in the browser to see the exact error.
Apache error log file location on cPanel servers : /usr/local/apache/logs/error_log
Apache error log file location on CentOS / RedHat / Fedora Servers : /etc/httpd/logs/error_log
Apache error log file location on Debian / Ubuntu Servers : /var/log/apache2/error.log
Apache error log location on a Plesk Server : /var/log/httpd/error_log
Apache Access logs
Apache Access log file Location on a cPanel Server : /usr/local/apache/logs/access_log
Apache Access log file location on Redhat / CentOS / Fedora Server : /var/log/httpd/access_log
Apache Access log file location on Debian / Ubuntu Servers : /var/log/apache2/access.log
Website errors and other logs related to apache are saved in this error_log file. On non-cpanel servers the log file is in a different location (/etc/httpd/logs/error_log)
Apache domlogs file: /usr/local/apache/domlogs/domain.com
Apache domlogs contain list of all IP addresses that accessed your site (IP address of visitors). You can also check the access log of your website here : /home/username/access-logs/domain.com
Apache suPHP audit log : /usr/local/apache/logs/suphp_log
mySQL Error log file Location on a cPanel WHM Server
MySQL log files are saved in the file /var/lib/mysql/Serverhostname.err
“Serverhostname” should be replaced with the actual server hostname.
Run the below command to check the MySQL slow query log file location on your server. Usually slow query logs are saved in /var/lib/mysql/
mysqladmin variables | grep -i slow_query_log_file
| slow_query_log_file | /var/lib/mysql/root-slow.log
On the above server slow query logs are saved in /var/lib/mysql/root-slow.log
FTP (ProFTPD & pure-FTPD) log file location on cPanel/WHM Server
FTP error and access logs on a cPanel Server are saved in the /var/log directory
/var/log/messages
OR
/var/log/xferlog
OR
/usr/local/apache/domlogs/ftpxferlog
cPanel Account Creation and Account Deletion logs
Account Creation, Account Deletion logs are saved in /var/cpanel/accounting.log on cPanel servers.
The below command will show all deleted cPanel account and when it was deleted.
root@server [~]# grep REMOVE /var/cpanel/accounting.log
Sun Nov 6 09:50:58 2011:REMOVE:admin:root:example.com:damien
The below command will show the creation date of all the accounts.
root@server [~]# grep CREATE /var/cpanel/accounting.log
Wed Oct 19 00:36:57 2011:CREATE:root:root:example.com:192.168.2.5:damien
cPanel Webmail log file location
On cPanel servers webmail logs are saved in /var/cPanel directory
Horde webmail logs directory : /var/cpanel/horde/log
SquirrelMail webmail log file directory : /var/cpanel/squirrelmail
Roundcube webmail log file directory : /var/cpanel/roundcube/log
SSH log file location
SSH log file contain successful and failed SSH login attempts. SSH logins and failures are saved in the below file.
SSH log file Location on Redhat and CentOS Servers : /var/log/secure
Example :
grep -i accepted /var/log/secure : This will shows all login attempts that were successful and the IP address from which they logged in.
SSH authentication log on Ubuntu / Debian servers : /var/log/auth.log
Yum log file location
Yum log file location on Linux / cPanel Servers : var/log/yum.log
To filter list of all Installed packages in yum log : cat /var/log/yum.log | grep -i installed
To filter list of all updated packages in yum log : cat /var/log/yum.log | grep -i Updated
To find list of packages uninstalled / Removed : cat /var/log/yum.log | grep -i Erased
Exim Mail Logs on a cPanel Server
/var/log/exim_mainlog : This log contains details of all incoming and outgoing emails from the server. You must check this log if you face any issues while sending or receiving any emails.
/var/log/exim_rejectlog : This logs contains emails that are rejected due to ACLs
/var/log/exim_paniclog : All errors related to exim service are saved in this log file.
/var/log/maillog : All IMAP/POP login details are saved in this log file (Courier, dovecot log file)
/usr/local/cpanel/3rdparty/mailmain/logs/ : Logs related to mailing lists are saved in this directory.
Cron Log file Location
Logs related to scheduled cron jobs are saved in /var/log/cron file. This this log file to check whether the scheduled cron job is running fine.
cPanel log files
On cPanel servers log files are saved in below directories :
/usr/local/cpanel/logs
/var/cpanel
/var/log
/usr/local/apache/logs