cPanelMichael

Technical Support Community Manager
Staff member
Apr 11, 2011
47,911
2,233
363
cPanel Access Level
DataCenter Provider
Twitter
Hello @Paulo Cesar,

You can review /usr/local/cpanel/logs/access_log to see when an email account's password was last changed through the cPanel interface. The entry will resemble the following:

Code:
/usr/local/cpanel/logs/access_log:$ClientIP - $account-username [03/11/2019:16:46:24 -0000] "POST /cpsess012345678/execute/Email/passwd_pop HTTP/1.1" 200 0 "https://$server-ip:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:65.0) Gecko/20100101 Firefox/65.0" "s" "-" 2083
Note that it will only list the cPanel username associated with the email account. I recommend voting for the following feature request if you'd like to see more log activity for this action:

Better user logs (i.e. change passwords / logins cpanel / logins whm)

Thank you.