Audit log of administrator access

eter4

Well-Known Member
Feb 16, 2002
58
0
306
Is there some sort of audit log that would show when/where an admin had logged into the cPanel interface and if they viewed emails on an account??

There is a suspicion that a clients administrator would have logged into the cPanel interface and access the mailbox of another employee, just trying to see if there is a way to see if there is an activity log of some sort. I don't believe there is but it's worth an ask.
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
6,810
892
313
cPanel Access Level
Root Administrator
There isn't a specific log that would show just those interactions, but the place to look would be the main cPanel access log at /usr/local/cpanel/logs/access_log. I like to re-create the action you are looking for, such as accessing a cPanel account for a certain user, so I can see an example of that action in the log, and then search the log for other similar entries. For example, accessing the Email Accounts button inside cPanel will show something similar to this in the access_log file:

Code:
208.74.123.98 - cpanelusername [09/29/2020:15:09:14 -0000] "GET /cpsess5129739064/frontend/paper_lantern/email_accounts/index.html HTTP/1.1" 200 0 "https://1.2.3.4:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0) Gecko/20100101 Firefox/81.0" "s" "-" 2083