If you have root access to your server and faces any issues, the best way to investigate those issues is to examine the server and cPanel logs.
cPanel provides us with such a list here: http://go.cpanel.net/logposter
The main log locations are in the table below in the event the above URL is missing or hard to read. Rows in yellow are deprecated.
cPanel logs | |
Access logs and user actions | /usr/local/cpanel/logs/access_log |
Account transfers and misc. logs | /var/cpanel/logs |
Auditing log (account creations, deletions, etc) | /var/cpanel/accounting.log |
Backup logs | /usr/local/cpanel/logs/cpbackup |
Brute force protection (cphulkd) log | /usr/local/cpanel/logs/cphulkd.log |
Cpanel dnsadmin dns clustering daemon | /usr/local/cpanel/logs/dnsadmin_log |
Cpanel taskqueue processing daemon | /usr/local/cpanel/logs/queueprocd.log |
DBmapping | /usr/local/cpanel/logs/setupdbmap_log |
EasyApache build logs | /usr/local/cpanel/logs/easy/apache/ |
Error log | /usr/local/cpanel/logs/error_log |
Installation log | /var/log/cpanel |
License updates and errors | /usr/local/cpanel/logs/license_log |
Locale database modifications | /usr/local/cpanel/logs/build_locale_database_log |
Login errors (CPSRVD) | /usr/local/cpanel/logs/login_log |
Horde | /var/cpanel/horde/log/ |
RoundCube | /var/cpanel/roundcube/log/ |
SquirrelMail | /var/cpanel/squirrelmail/ |
Panic log | /usr/local/cpanel/logs/panic_log |
Per account bandwidth history (Cached) | /var/cpanel/bandwidth.cache/{USERNAME} |
Per account bandwidth history (Human Readable) | /var/cpanel/bandwidth/{USERNAME} |
Service status logs | /var/log/chkservd.log |
Tailwatch driver tailwatchd log | /usr/local/cpanel/logs/tailwatch_log |
Update analysis reporting | /usr/local/cpanel/logs/updated_analysis/{TIMESTAMP}.log |
Update (UPCP) log | /var/cpanel/updatelogs/updated.{TIMESTAMP}.log |
WebDisk (CPDAVD) | /usr/local/cpanel/logs/cpdavd_error_log |
Website statistics log | /usr/local/cpanel/logs/stats_log |
Access logs and user actions | /usr/local/cpanel/logs/access_log |
Apache (web service) logs | |
Apache restarts done through cPanel and WHM | /usr/local/cpanel/logs/safeapcherestart_log |
Domain access logs | /usr/local/apache/domlogs/{DOMAIN} |
Processing of log splitting | /usr/local/cpanel/logs/splitlogs_log |
suPHP audit log | /usr/local/apache/logs/suphp_log |
Web server and CGI application error log | /usr/local/apache/logs/error_log |
Exim (mail service) logs | |
Delivery and receipt log | /var/log/exim_mainlog |
Incoming mail queue | /var/spool/exim/input/ |
Log of messages rejected based on ACLS or other policies | /var/log/exim_rejectlog |
Unexpected/Fatal error log | /var/log/exim_paniclog |
IMAP, POP login attempts, transactions, fatal errors and spam scoring | /var/log/maillog /var/log/messages |
Mailman | /usr/local/cpanel/3rdparty/mailmain/logs |
MySQL (database service) logs | |
MySQL error log | /var/lib/mysql/{SERVER_NAME}.err |
MySQL slow query log (if enabled in my.cnf) | /var/log/slowqueries |