Audit log of administrator access

[eter4]

Is there some sort of audit log that would show when/where an admin had logged into the cPanel interface and if they viewed emails on an account??

There is a suspicion that a clients administrator would have logged into the cPanel interface and access the mailbox of another employee, just trying to see if there is a way to see if there is an activity log of some sort. I don't believe there is but it's worth an ask.

 

[cPRex]

There isn't a specific log that would show just those interactions, but the place to look would be the main cPanel access log at /usr/local/cpanel/logs/access_log. I like to re-create the action you are looking for, such as accessing a cPanel account for a certain user, so I can see an example of that action in the log, and then search the log for other similar entries. For example, accessing the Email Accounts button inside cPanel will show something similar to this in the access_log file:

208.74.123.98 - cpanelusername [09/29/2020:15:09:14 -0000] "GET /cpsess5129739064/frontend/paper_lantern/email_accounts/index.html HTTP/1.1" 200 0 "https://1.2.3.4:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0) Gecko/20100101 Firefox/81.0" "s" "-" 2083