cPanel Log Locations

Default locations of common cPanel logs
These will require 'root' access to view

cPanel/WHM/Webmail

Access log:

 usr/local/cpanel/logs/access_log 

Error log for related pages:

 usr/local/cpanel/logs/error_log 

Modsec Audit Log:

 /var/log/apache2/modsec_audit.log 

Authentication onto cPanel:

 /usr/local/cpanel/logs/login_log 

Individual site web logs

Current access logs can be found here, they are seperated per domain:

/usr/local/apache/domlogs/[domain]
/usr/local/apache/domlogs/[domain]-ssl_log 

cPanel will automatically rotate the apache logs and archive them under the users cPanel directory

/home/[~username]/logs/[domain]-[mmm]-[yyyy].gz
/home/[~username]/logs/[domain]-ssl_log-[mmm]-[yyyy].gz 

Error logs's can be grep'd out of the following location

/usr/local/apache/error_log 

Email: Exim/ Dovecot

Email's processed by the server can be found in the exim_mainlog

/var/log/exim_mainlog 

IMAP/POP3 Authentications can be found in the mainlog

/var/log/mainlog

FTP

Log's for FTP can be found in messages, you will need to grep 'ftp' and possibly the user or IP

/var/log/messages

SSH

SSH connections and sessions are tracked in the following log

/var/log/secure