Questions about User's last access

000

Well-Known Member
Jun 3, 2008
356
14
68
really is possiible from SHELL "compose" commands to get the report of:

Code:
- list of last access to cPanel of users, order by DATE DESC;
- list of last access to cPanel of users, order by USERNAME ASC;
- list of NUMBER ACCESS to cPanel in current [month/week] of users, order by number_of_access DESC;
???

if yes,
please share.


Thanks
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
5,447
697
313
cPanel Access Level
Root Administrator
Hey there! I'm not aware of any commands that would provide that information. You would need to search for the username inside the /usr/local/cpanel/logs/access_log file to get these details, performing a unique search for each user.
 

000

Well-Known Member
Jun 3, 2008
356
14
68
Hey there! I'm not aware of any commands that would provide that information. You would need to search for the username inside the /usr/local/cpanel/logs/access_log file to get these details, performing a unique search for each user.
Thanks master, when I say "command" I refer to:
Code:
grep filter1, filter2, ... ,regex1, regex2, ... /usr/local/cpanel/logs/access_log
caacn you help to us for compose the correct line?
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
5,447
697
313
cPanel Access Level
Root Administrator
There isn't going to be one command that will get you all that information, but here is an example of what a cPanel login looks like if I watch the access_log file:

Code:
1.2.3.4 - username [04/05/2021:14:50:05 -0000] "GET /cpsess4862993445/login/?session=username:UkJBOE4W7wVTNKMw,e2ce648a63c91dc1d750c2bb976795b3 HTTP/1.1" 307 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:87.0) Gecko/20100101 Firefox/87.0" "-" "-" 2083
1.2.3.4 - username [04/05/2021:14:50:06 -0000] "GET /cpsess5095179134/frontend/paper_lantern/index.html?login=1&post_login=7793286819386 HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:87.0) Gecko/20100101 Firefox/87.0" "s" "-" 2083
In that example, 1.2.3.4 is the IP address that is accessing the server.