Common Log File Locations on Linux and cPanel Servers

Updated: 29 September 2026 · Applies to: AlmaLinux and Rocky Linux 9 and 10, Ubuntu 24.04 and 26.04, Debian 13; cPanel & WHM 138 (paths checked on an AlmaLinux 9 cPanel server)

When something goes wrong on a server, the answer is usually in a log file. This list shows where the common logs are on current Linux systems and on cPanel servers. We checked every cPanel path on a cPanel & WHM 138 server. Custom setups can move logs elsewhere.

The systemd journal (all current distributions)

Most services log to the journal, which you read with journalctl:

journalctl -b                  # everything since the last boot
journalctl -u sshd -n 50       # the last 50 lines of one service (ssh on Ubuntu and Debian)
journalctl -p err -b           # only errors
journalctl -f                  # follow new messages live

Debian 13 has no rsyslog by default, so there the journal is the only system log unless you install rsyslog.

System logs as text files

• General system messages: /var/log/messages (AlmaLinux, Rocky Linux, RHEL), /var/log/syslog (Ubuntu, and Debian with rsyslog).
• Logins, sudo and SSH: /var/log/secure (AlmaLinux, Rocky Linux, RHEL), /var/log/auth.log (Ubuntu, Debian with rsyslog).
• Kernel messages: dmesg or journalctl -k; also /var/log/kern.log on Ubuntu.
• Cron: /var/log/cron (AlmaLinux, Rocky Linux, RHEL); on Ubuntu and Debian in syslog or journalctl -u cron.
• Package installs and updates: /var/log/dnf.log and /var/log/dnf.rpm.log; /var/log/apt/history.log and /var/log/dpkg.log.
• Mail (Postfix, Dovecot): /var/log/maillog (AlmaLinux, Rocky Linux, RHEL), /var/log/mail.log (Ubuntu, Debian with rsyslog).
• Audit and SELinux: /var/log/audit/audit.log.
• Login history: last and lastb read /var/log/wtmp and /var/log/btmp on AlmaLinux, Rocky Linux and Ubuntu 24.04.

Web servers and databases (without a control panel)

• Apache: /var/log/httpd/ (AlmaLinux, Rocky Linux, RHEL), /var/log/apache2/ (Ubuntu, Debian).
• Nginx: /var/log/nginx/access.log and error.log.
• PHP-FPM: /var/log/php-fpm/ (AlmaLinux, Rocky Linux, RHEL), /var/log/php8.3-fpm.log or similar on Ubuntu and Debian.
• MariaDB and MySQL: /var/log/mariadb/, /var/log/mysql/, or the journal; mysql -e "SELECT @@log_error" shows the error log in use.

cPanel and WHM

• /usr/local/cpanel/logs/error_log: errors of cPanel and WHM.
• /usr/local/cpanel/logs/login_log: logins to cPanel, WHM and Webmail, including failures.
• /usr/local/cpanel/logs/access_log: requests to the cPanel and WHM interfaces.
• /usr/local/cpanel/logs/cphulkd.log: brute-force protection (cPHulk) events.
• /var/cpanel/accounting.log: account creations, changes and removals.
• /var/cpanel/updatelogs/: cPanel updates (upcp).

Web server on cPanel

• /var/log/apache2/error_log and access_log (the same files are reachable as /etc/apache2/logs/ and /usr/local/apache/logs/).
• /var/log/apache2/domlogs/: one access log per domain.
• /var/log/apache2/modsec_audit.log: ModSecurity blocks.
• /var/log/nginx/: when cPanel's NGINX reverse proxy is installed.

Mail and databases on cPanel

• /var/log/exim_mainlog: every message sent and received; exim_rejectlog and exim_paniclog for rejections and serious errors.
• /var/log/maillog: IMAP and POP3 logins (Dovecot).
• MariaDB error log: set by log-error in /etc/my.cnf, usually /var/lib/mysql/HOSTNAME.err.

Finding things in logs

tail -f /var/log/exim_mainlog                          # follow a log live
grep 'user@example.com' /var/log/exim_mainlog | tail   # search a log
zgrep 'error' /var/log/messages-*.gz                   # search rotated, compressed logs

For more cPanel commands, see top cPanel commands and files every server admin should know.

Official documentation: journalctl manual and cPanel & WHM documentation.