# Linux Server Log File Locations: cPanel, DirectAdmin, AlmaLinux and Debian (Checked 2026)

Source: https://srvscripts.com/guides/linux-server-log-file-locations/
Updated: 2026-10-11
Publisher: srvScripts (https://srvscripts.com/)

**Short answer:** on AlmaLinux and other RHEL-style servers, system logs are `/var/log/messages`, SSH logins `/var/log/secure` and mail `/var/log/maillog`. Debian and Ubuntu use `/var/log/syslog`, `/var/log/auth.log` and `/var/log/mail.log`. Those text files only exist when `rsyslog` is installed. On new AlmaLinux 9 cloud images and on Debian 12 it often is not, and everything is in the systemd journal instead: read it with `journalctl`. cPanel keeps Apache logs in `/var/log/apache2` (per site in `domlogs`), Exim in `/var/log/exim_mainlog` and its own logs in `/usr/local/cpanel/logs`. DirectAdmin uses `/var/log/httpd/domains`, `/var/log/exim/mainlog` and `/var/log/directadmin`.

We checked every path on this page on three lab servers on 11 October 2026: cPanel 138 on AlmaLinux 9.8, DirectAdmin 1.712 on AlmaLinux 9.8, and Debian 12. Paths that were missing on our servers are marked as such.

## First check: does this server write text log files at all?

Before you look for `/var/log/messages`, check whether a syslog daemon is installed:

```
rpm -q rsyslog            # AlmaLinux, Rocky, CloudLinux
dpkg -l rsyslog           # Debian, Ubuntu
ls -d /var/log/journal    # exists = the journal is kept on disk
```

On our cPanel lab (AlmaLinux 9.8 cloud image), `rsyslog` had never been installed. There was no `/var/log/messages`, `/var/log/maillog` or `/var/log/cron`, and `/var/log/secure` existed but stayed empty. Dovecot, cron, SSH and FTP messages still existed, but only in the journal. Worse, there was no `/var/log/journal` directory, so the journal lived in `/run/log/journal` and would have been lost at the next reboot.

Debian 12 behaves the same by design: its release notes say rsyslog “is no longer installed by default” from bookworm, and logs are read with `journalctl`. Our Debian lab had text logs only because the FreePBX installer had installed rsyslog.

This matters because tools that read text files see nothing without them. CSF’s `lfd`, for example, watches `/var/log/secure` and `/var/log/maillog` for login failures. You have two options:

- **Keep only the journal and make it persistent** (see [journalctl commands](/guides/journalctl-commands-cheat-sheet/)): `mkdir -p /var/log/journal && systemd-tmpfiles --create --prefix /var/log/journal && journalctl --flush`.

- **Bring the text files back** on AlmaLinux 9: `dnf install rsyslog rsyslog-logrotate`, then `systemctl enable --now rsyslog`. On our lab, the five files appeared at once and rsyslog filled them from the existing journal. `rsyslog-logrotate` adds `/etc/logrotate.d/rsyslog`; without it the files are never rotated, which cPanel describes in its support article on the missing syslog logrotate file. On Debian: `apt install rsyslog`.

## AlmaLinux, Rocky and CloudLinux (any panel)

| Log | Path | Notes |
| --- | --- | --- |
| System messages | /var/log/messages | Only with rsyslog. Otherwise journalctl |
| SSH and sudo logins | /var/log/secure | Only with rsyslog. Otherwise journalctl -u sshd |
| Mail (Dovecot, Postfix) | /var/log/maillog | Only with rsyslog. Exim on panels has its own logs (below) |
| Cron | /var/log/cron | Only with rsyslog. Otherwise journalctl -t CROND |
| Package installs and updates | /var/log/dnf.log, /var/log/dnf.rpm.log | Also dnf history |
| Kernel | journalctl -k | dmesg shows only the current boot’s ring buffer |
| Audit (SELinux, auditd) | /var/log/audit/audit.log | Search with ausearch |
| Login history | /var/log/wtmp, /var/log/btmp, /var/log/lastlog | Binary: read with last, lastb, lastlog |
| Performance history | /var/log/sa/saDD | From sysstat; read with sar |
| Plain Apache (no panel) | /var/log/httpd/access_log, error_log |  |
| Plain MariaDB (no panel) | /var/log/mariadb/mariadb.log | Confirm with mysql -e 'select @@log_error' |

## cPanel & WHM log files

On cPanel 138, `/usr/local/apache/logs` and `/etc/apache2/logs` are symlinks to `/var/log/apache2`, so old guides that use the `/usr/local/apache` paths still work.

| Log | Path |
| --- | --- |
| Apache error log | /var/log/apache2/error_log |
| Apache access log (server-wide) | /var/log/apache2/access_log |
| Per-site access logs | /var/log/apache2/domlogs/DOMAIN and DOMAIN-ssl_log (bandwidth: DOMAIN-bytes_log); some are in a domlogs/USER/ folder |
| Archived per-site logs | /home/USER/logs/DOMAIN-Mon-YYYY.gz (if log archiving is on) |
| ModSecurity | /var/log/apache2/modsec_audit.log |
| suEXEC | /var/log/apache2/suexec_log |
| PHP errors of a site | /home/USER/public_html/error_log (next to the script that failed) |
| PHP-FPM pool errors | /opt/cpanel/ea-phpXX/root/usr/var/log/php-fpm/error.log |
| Exim (mail sent and received) | /var/log/exim_mainlog, exim_rejectlog, exim_paniclog |
| Dovecot (IMAP/POP3 logins) | /var/log/maillog with rsyslog; otherwise journalctl -u dovecot |
| cPanel/WHM interface errors | /usr/local/cpanel/logs/error_log |
| cPanel/WHM requests and logins | /usr/local/cpanel/logs/access_log, login_log, session_log |
| cPHulk brute-force protection | /usr/local/cpanel/logs/cphulkd.log |
| Licence checks | /usr/local/cpanel/logs/license_log |
| Updates (upcp) | /var/cpanel/updatelogs/update.*.log |
| Service monitor (chkservd) | /var/log/chkservd.log |
| Background tasks | /usr/local/cpanel/logs/queueprocd.log, tailwatchd_log |
| Statistics processing | /usr/local/cpanel/logs/stats_log |
| MySQL/MariaDB errors | /var/lib/mysql/HOSTNAME.err (our lab) |
| FTP transfers | /var/log/apache2/domlogs/ftpxferlog; logins in /var/log/messages or journalctl -t pure-ftpd |
| Imunify360 / ImunifyAV | /var/log/imunify360/console.log |
| LiteSpeed (if installed) | /usr/local/lsws/logs/error.log |

For Exim search commands, see the [Exim log cheat sheet](/guides/exim-log-cheat-sheet/). To keep more Apache history, see [cPanel Apache log retention](/guides/cpanel-apache-log-retention/).

## DirectAdmin log files

| Log | Path |
| --- | --- |
| Apache error and access (server-wide) | /var/log/httpd/error_log, access_log |
| Per-site logs | /var/log/httpd/domains/DOMAIN.log, DOMAIN.error.log, DOMAIN.bytes |
| Nginx or OpenLiteSpeed (if used) | /var/log/nginx/; /usr/local/lsws/logs/ |
| Exim | /var/log/exim/mainlog, rejectlog, paniclog |
| Dovecot | /var/log/maillog; LMTP delivery in /var/log/dovecot-lmtp.log and dovecot-lmtp-errors.log |
| DirectAdmin daemon | /var/log/directadmin/error.log, system.log, login.log, security.log, access.log |
| Task queue errors | /var/log/directadmin/errortaskq.log |
| CustomBuild runs | /var/log/directadmin/custombuild.*.log (one file per run) |
| PHP-FPM | /usr/local/phpXX/var/log/php-fpm.log (for example php83) |
| MariaDB errors | /var/log/mariadb/mariadb.log (our lab’s log_error) |
| FTP | /var/log/pureftpd.log or /var/log/proftpd/ |
| CSF/lfd | /var/log/lfd.log |

Our DirectAdmin lab had rsyslog installed, so `/var/log/messages`, `secure`, `maillog` and `cron` were all there, rotated by `/etc/logrotate.d/rsyslog`. For PHP-FPM errors behind a 503, see [DirectAdmin 503 errors: read PHP-FPM in journalctl](/guides/directadmin-503-php-fpm-journalctl/).

## Debian and Ubuntu

| Log | Path | Notes |
| --- | --- | --- |
| System messages | /var/log/syslog | Only with rsyslog (not installed by default on Debian 12) |
| SSH and sudo | /var/log/auth.log | Otherwise journalctl -u ssh (the unit is ssh, not sshd) |
| Mail | /var/log/mail.log | Exim on Debian also writes /var/log/exim4/mainlog |
| Kernel | /var/log/kern.log | Or journalctl -k |
| Apache | /var/log/apache2/access.log, error.log, other_vhosts_access.log | Note the dot: access.log, not access_log |
| Nginx | /var/log/nginx/access.log, error.log |  |
| Packages | /var/log/apt/history.log, term.log, /var/log/dpkg.log |  |
| Automatic updates | /var/log/unattended-upgrades/ | If unattended-upgrades is installed |
| MariaDB/MySQL | /var/log/mysql/error.log or the journal | Check @@log_error |
| fail2ban | /var/log/fail2ban.log |  |

## Find any other log quickly

```
# Which files changed in the last 10 minutes?
find /var/log /usr/local/cpanel/logs /usr/local/apache/logs -type f -mmin -10 2>/dev/null

# Where does a running service write? (open log files of PID 1234)
ls -l /proc/1234/fd | grep -i log

# Where does MariaDB/MySQL log errors and slow queries?
mysql -NBe 'select @@log_error, @@slow_query_log_file'

# Biggest logs (a full /var is often a log)
du -ah /var/log 2>/dev/null | sort -rh | head -15
```

If `/var` is full, see [our disk full runbook](/guides/runbook-disk-full/). To summarise a web [access log](https://srvscripts.com/tools/access-log-analyzer/), try [GoAccess](/guides/goaccess-cpanel-awstats-replacement/) or the [web log top IPs script](/scripts/web-log-top-ips/); to explain an error line, paste it into the [AI log analyzer](/tools/ai-log-analyzer/).

## Frequently asked questions

### Why is /var/log/messages missing on my AlmaLinux 9 server?

rsyslog is not installed, so nothing writes the text log files. Read the same messages with journalctl, or install rsyslog and rsyslog-logrotate with dnf and enable the rsyslog service.

### Where are the Apache logs on cPanel?

In /var/log/apache2: error_log and access_log for the server, and domlogs/ for each site (DOMAIN and DOMAIN-ssl_log). /usr/local/apache/logs is a symlink to the same folder on cPanel 138.

### Where are the Exim logs on DirectAdmin?

In /var/log/exim/: mainlog, rejectlog and paniclog. On cPanel they are /var/log/exim_mainlog, /var/log/exim_rejectlog and /var/log/exim_paniclog.

### Where is /var/log/syslog on Debian 12?

Debian 12 does not install rsyslog by default, so there is no /var/log/syslog. Use journalctl, or install rsyslog with apt to get the text files back.

### Where do I find SSH login attempts?

In /var/log/secure on AlmaLinux and /var/log/auth.log on Debian when rsyslog is installed. Otherwise run journalctl -u sshd (AlmaLinux) or journalctl -u ssh (Debian).