In the recent days, we all are facing the hacking issue at that time, we always see problem like account termination from the serve at that time, we can use the following log file to investigate the issue as its providing when hosting account was created, owner changed or account deleted from the server.
For example we are checking logs for the domain test123.com and as per the following logs the hosting account for domain test123.com is created by using the root owner on dated Wed Jan 11 08:19:40 2012 and onwership is under root
root@linux7802 [~]# cat /var/cpanel/accounting.log | grep test123.com
Wed Jan 11 08:19:40 2012:CREATE:root:root:test123.com:115.124.103.126:admin111
Now we have changed the ownership for the domain test123.com hosting account to linux780 reseller ownership therefore check the following logs
root@linux7802 [~]# cat /var/cpanel/accounting.log | grep test123.com
Wed Jan 11 08:22:51 2012:CHANGEOWNER:root:root:test123.com:admin111:root:linux780
Now we have terminated the hosting account for the domain test123.com by using the root user and its also recorded in the accounting.log
root@linux7802 [~]# cat /var/cpanel/accounting.log | grep test123.com
Wed Jan 11 08:25:14 2012:REMOVE:root:root:test123.com:admin111
So we can similarly check the logs for all the domains when they have created/modified or removed from the server and its always to better to maintain the accounting.log for future reference.
