Track Webmail Logins On cPanel← Back
28 Jun, 2013
If a user suspects unauthorised logins to their email on cPanel or you wish to perform an audit on a user, you can pull the IP, username and date/time from cPanel's access_log.
# tail -10000 /usr/local/cpanel/logs/access_log|grep "user\@domain.com"|cut -d " " -f 1-5
From that command, you will get output similar to:
18.104.22.168 - firstname.lastname@example.org [06/13/2013:12:13:11 -0000]