Find who deleted email accounts

kodeslogic

Well-Known Member
PartnerNOC
Apr 26, 2020
423
200
118
IN
cPanel Access Level
Root Administrator
Check cPanel access logs

Code:
#cat /usr/local/cpanel/logs/access_log | grep "delete_pop"
 
  • Like
Reactions: benito

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
9,686
1,511
313
cPanel Access Level
Root Administrator
The cPanel access_log file would be the best place to see who logged in with cPanel services or used a cPanel tool to remove the account. If the work was done over FTP you may be able to get additional details from the /var/log/messages file on the system.