Find who deleted email accounts

[benito]

Hello! Where i have to look who deleted several email accounts? A customer says he didn't do it and i want to give him some proof that someone with access to his cPanel or FTP account deleted the email addresses.

Thanks

 

[kodeslogic]

Check cPanel access logs

#cat /usr/local/cpanel/logs/access_log | grep "delete_pop"

 

[benito]

Check cPanel access logs

#cat /usr/local/cpanel/logs/access_log | grep "delete_pop"

Thanks! Very usefull, i think the accounts where deleted by FTP.

 

[cPRex]

The cPanel access_log file would be the best place to see who logged in with cPanel services or used a cPanel tool to remove the account. If the work was done over FTP you may be able to get additional details from the /var/log/messages file on the system.