Linux Server Log File Locations: cPanel, DirectAdmin, AlmaLinux and Debian (Checked 2026)

Short answer: on AlmaLinux and other RHEL-style servers, system logs are /var/log/messages, SSH logins /var/log/secure and mail /var/log/maillog. Debian and Ubuntu use /var/log/syslog, /var/log/auth.log and /var/log/mail.log. Those text files only exist when rsyslog is installed. On new AlmaLinux 9 cloud images and on Debian 12 it often is not, and everything is in the systemd journal instead: read it with journalctl. cPanel keeps Apache logs in /var/log/apache2 (per site in domlogs), Exim in /var/log/exim_mainlog and its own logs in /usr/local/cpanel/logs. DirectAdmin uses /var/log/httpd/domains, /var/log/exim/mainlog and /var/log/directadmin.

Applies to cPanel & WHM 138.0 build 15 on AlmaLinux 9.8; DirectAdmin 1.712 on AlmaLinux 9.8; Debian 12 (systemd 252); lab check 11 Oct 2026

We checked every path on this page on three lab servers on 11 October 2026: cPanel 138 on AlmaLinux 9.8, DirectAdmin 1.712 on AlmaLinux 9.8, and Debian 12. Paths that were missing on our servers are marked as such.

First check: does this server write text log files at all?

Before you look for /var/log/messages, check whether a syslog daemon is installed:

rpm -q rsyslog            # AlmaLinux, Rocky, CloudLinux
dpkg -l rsyslog           # Debian, Ubuntu
ls -d /var/log/journal    # exists = the journal is kept on disk

On our cPanel lab (AlmaLinux 9.8 cloud image), rsyslog had never been installed. There was no /var/log/messages, /var/log/maillog or /var/log/cron, and /var/log/secure existed but stayed empty. Dovecot, cron, SSH and FTP messages still existed, but only in the journal. Worse, there was no /var/log/journal directory, so the journal lived in /run/log/journal and would have been lost at the next reboot.

Debian 12 behaves the same by design: its release notes say rsyslog “is no longer installed by default” from bookworm, and logs are read with journalctl. Our Debian lab had text logs only because the FreePBX installer had installed rsyslog.

This matters because tools that read text files see nothing without them. CSF’s lfd, for example, watches /var/log/secure and /var/log/maillog for login failures. You have two options:

• Keep only the journal and make it persistent (see journalctl commands): mkdir -p /var/log/journal && systemd-tmpfiles --create --prefix /var/log/journal && journalctl --flush.
• Bring the text files back on AlmaLinux 9: dnf install rsyslog rsyslog-logrotate, then systemctl enable --now rsyslog. On our lab, the five files appeared at once and rsyslog filled them from the existing journal. rsyslog-logrotate adds /etc/logrotate.d/rsyslog; without it the files are never rotated, which cPanel describes in its support article on the missing syslog logrotate file. On Debian: apt install rsyslog.

AlmaLinux, Rocky and CloudLinux (any panel)

Log	Path	Notes
System messages	/var/log/messages	Only with rsyslog. Otherwise journalctl
SSH and sudo logins	/var/log/secure	Only with rsyslog. Otherwise journalctl -u sshd
Mail (Dovecot, Postfix)	/var/log/maillog	Only with rsyslog. Exim on panels has its own logs (below)
Cron	/var/log/cron	Only with rsyslog. Otherwise journalctl -t CROND
Package installs and updates	/var/log/dnf.log, /var/log/dnf.rpm.log	Also dnf history
Kernel	journalctl -k	dmesg shows only the current boot’s ring buffer
Audit (SELinux, auditd)	/var/log/audit/audit.log	Search with ausearch
Login history	/var/log/wtmp, /var/log/btmp, /var/log/lastlog	Binary: read with last, lastb, lastlog
Performance history	/var/log/sa/saDD	From sysstat; read with sar
Plain Apache (no panel)	/var/log/httpd/access_log, error_log
Plain MariaDB (no panel)	/var/log/mariadb/mariadb.log	Confirm with mysql -e 'select @@log_error'

cPanel & WHM log files

On cPanel 138, /usr/local/apache/logs and /etc/apache2/logs are symlinks to /var/log/apache2, so old guides that use the /usr/local/apache paths still work.

Log	Path
Apache error log	/var/log/apache2/error_log
Apache access log (server-wide)	/var/log/apache2/access_log
Per-site access logs	/var/log/apache2/domlogs/DOMAIN and DOMAIN-ssl_log (bandwidth: DOMAIN-bytes_log); some are in a domlogs/USER/ folder
Archived per-site logs	/home/USER/logs/DOMAIN-Mon-YYYY.gz (if log archiving is on)
ModSecurity	/var/log/apache2/modsec_audit.log
suEXEC	/var/log/apache2/suexec_log
PHP errors of a site	/home/USER/public_html/error_log (next to the script that failed)
PHP-FPM pool errors	/opt/cpanel/ea-phpXX/root/usr/var/log/php-fpm/error.log
Exim (mail sent and received)	/var/log/exim_mainlog, exim_rejectlog, exim_paniclog
Dovecot (IMAP/POP3 logins)	/var/log/maillog with rsyslog; otherwise journalctl -u dovecot
cPanel/WHM interface errors	/usr/local/cpanel/logs/error_log
cPanel/WHM requests and logins	/usr/local/cpanel/logs/access_log, login_log, session_log
cPHulk brute-force protection	/usr/local/cpanel/logs/cphulkd.log
Licence checks	/usr/local/cpanel/logs/license_log
Updates (upcp)	/var/cpanel/updatelogs/update.*.log
Service monitor (chkservd)	/var/log/chkservd.log
Background tasks	/usr/local/cpanel/logs/queueprocd.log, tailwatchd_log
Statistics processing	/usr/local/cpanel/logs/stats_log
MySQL/MariaDB errors	/var/lib/mysql/HOSTNAME.err (our lab)
FTP transfers	/var/log/apache2/domlogs/ftpxferlog; logins in /var/log/messages or journalctl -t pure-ftpd
Imunify360 / ImunifyAV	/var/log/imunify360/console.log
LiteSpeed (if installed)	/usr/local/lsws/logs/error.log

For Exim search commands, see the Exim log cheat sheet. To keep more Apache history, see cPanel Apache log retention.

DirectAdmin log files

Log	Path
Apache error and access (server-wide)	/var/log/httpd/error_log, access_log
Per-site logs	/var/log/httpd/domains/DOMAIN.log, DOMAIN.error.log, DOMAIN.bytes
Nginx or OpenLiteSpeed (if used)	/var/log/nginx/; /usr/local/lsws/logs/
Exim	/var/log/exim/mainlog, rejectlog, paniclog
Dovecot	/var/log/maillog; LMTP delivery in /var/log/dovecot-lmtp.log and dovecot-lmtp-errors.log
DirectAdmin daemon	/var/log/directadmin/error.log, system.log, login.log, security.log, access.log
Task queue errors	/var/log/directadmin/errortaskq.log
CustomBuild runs	/var/log/directadmin/custombuild.*.log (one file per run)
PHP-FPM	/usr/local/phpXX/var/log/php-fpm.log (for example php83)
MariaDB errors	/var/log/mariadb/mariadb.log (our lab’s log_error)
FTP	/var/log/pureftpd.log or /var/log/proftpd/
CSF/lfd	/var/log/lfd.log

Our DirectAdmin lab had rsyslog installed, so /var/log/messages, secure, maillog and cron were all there, rotated by /etc/logrotate.d/rsyslog. For PHP-FPM errors behind a 503, see DirectAdmin 503 errors: read PHP-FPM in journalctl.

Debian and Ubuntu

Log	Path	Notes
System messages	/var/log/syslog	Only with rsyslog (not installed by default on Debian 12)
SSH and sudo	/var/log/auth.log	Otherwise journalctl -u ssh (the unit is ssh, not sshd)
Mail	/var/log/mail.log	Exim on Debian also writes /var/log/exim4/mainlog
Kernel	/var/log/kern.log	Or journalctl -k
Apache	/var/log/apache2/access.log, error.log, other_vhosts_access.log	Note the dot: access.log, not access_log
Nginx	/var/log/nginx/access.log, error.log
Packages	/var/log/apt/history.log, term.log, /var/log/dpkg.log
Automatic updates	/var/log/unattended-upgrades/	If unattended-upgrades is installed
MariaDB/MySQL	/var/log/mysql/error.log or the journal	Check @@log_error
fail2ban	/var/log/fail2ban.log

Find any other log quickly

# Which files changed in the last 10 minutes?
find /var/log /usr/local/cpanel/logs /usr/local/apache/logs -type f -mmin -10 2>/dev/null

# Where does a running service write? (open log files of PID 1234)
ls -l /proc/1234/fd | grep -i log

# Where does MariaDB/MySQL log errors and slow queries?
mysql -NBe 'select @@log_error, @@slow_query_log_file'

# Biggest logs (a full /var is often a log)
du -ah /var/log 2>/dev/null | sort -rh | head -15

If /var is full, see our disk full runbook. To summarise a web access log, try GoAccess or the web log top IPs script; to explain an error line, paste it into the AI log analyzer.

Frequently asked questions

Reading a lot of our guides? Go ad-free with srvScripts Pro for $6 a month. It also pays for new guides. Cancel any time.