Apache:
/usr/local/apache/logs/access_log
/usr/local/apache/logs/error_log
Apache domlogs:
/usr/local/apache/domlogs/example.com
Apache SUEXEC Logs:
/usr/local/apache/logs/suexec_log
MySQL
/var/lib/mysql/hostname.err
BIND (named) Log:
/var/log/messages
Exim
/var/log/exim_mainlog
/var/log/exim_paniclog
/var/log/exim_rejectlog
Courier or Dovecot IMAP
/var/log/maillog
Tomcat Logs:
/usr/local/jakarta/tomcat/logs/catalina.err
/usr/local/jakarta/tomcat/logs/catalina.out
cPanel Access Log:
/usr/local/cpanel/logs/access_log
cPanel Error Log:
/usr/local/cpanel/logs/error_log
cPanel License Log:
/usr/local/cpanel/logs/license_log
Stats Execution Logs:
/usr/local/cpanel/logs/stats_log
ChkServd (cPanel Monitoring Daemon) Logs:
/var/log/chkservd.log
cPHulkd
/usr/local/cpanel/logs/cphulkd.log
cPanel Backup Logs:
/usr/local/cpanel/logs/cpbackup/*.log
Pure-FTP
/var/log/messages
/var/log/xferlog (symlinked to /usr/local/apache/domlogs/ftpxferlog)
Cron Logs:
/var/log/cron
SSH Logs:
/var/log/secure
ModSecurity:
/usr/local/apache/logs/modsec_audit.log
/usr/local/apache/logs/modsec_debug_log
Check for account creation/terminatoin date
grep cpaneluser /var/cpanel/accounting.log
Check Access Log for a specific time
grep Oct/2013 /usr/local/apache/logs/access_log | awk '{ print $1 }' | sort -n | uniq -c | sort -rn
cPanel guide for Log Rotation
Fix broken log rotation
If munin logs are not being rotated properly you can add the following script to correct that. This essentially allows the log files to grow up to 50M before rotating them.
Create a file named "munin" within /etc/logrotate.d and put in the following code:
/var/log/munin/*log {
weekly
size 50M
rotate 5
compress
missingok
notifempty
sharedscripts
postrotate
/sbin/service munin-node restart > /dev/null 2>/dev/null || true
endscript
}