WHM Root log

[Apoc]

Is there any such thing as a WHM root access log? I am constantly monitoring SSH but I would like to monitor this too.

Please let me know whether this can be done.

[dgbaker]

The info you seek is stored in /usr/local/cpanel/logs

access_log -> grep for 2086 or 2087

[jmetcalf]

Is it just me or does cpanel log all access from all IP addresses as 127.0.0.1? This is very disconcerting to me. I would like to know who is attempting access.

[PWSowner]

When using the secure connection, it's always recorded as 127.0.0.1. It would be nice if it still logged the IP, but due to how it works, it doesn't.