Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tried to login into a cpanel account that hasn't been accessed for a few months and discovered that my login details no longer worked. When I reset the password and gained access into my domains control panel, my email password also didn't work. Upon that first attempt I was given a message reading "Brute force attempt..."

Does cpanel keep a list of logins? Or login attempts?

share|improve this question

closed as off-topic by HopelessN00b Jan 13 '15 at 21:01

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

This question appears to be off-topic because it is about working with a service provider's management interface, such as cPanel. – HopelessN00b Jan 13 '15 at 21:01

I know this is an old topic but for future readers, check


That log shows a list of failed login attempts and deferred login attempts.

share|improve this answer
Confirmed on my VPS. Thanks for the tip! – Royce Williams Jan 8 '12 at 16:23

check under /usr/local/cpanel/logs/access_log

share|improve this answer
But logs file shows all connections, what do you search in it to find out login attempts? – Marco Demaio Aug 19 '10 at 13:15
@Marco Demaio you should grep the log for logins like user@domain.tld – Mr Shunz Aug 20 '10 at 9:36
it works I searched for the user name that can login. Interesting, thanks! But what about the login attempts jeff is asking for? How do I look for login attempt that maybe failed? – Marco Demaio Aug 20 '10 at 15:55
@Marco Demaio actually there's another logfile: /usr/local/cpanel/logs/login_log which contains all auth attempts, you can find something like this: X.X.X.X - [06/18/2010:20:48:43 -0000] "POST /login/ HTTP/1.1" FAILED LOGIN webmaild: user name not specified or invalid user – Mr Shunz Aug 21 '10 at 9:07