Linux Servers cPanel webhosting blog

Archive for the ‘Basic Linux’ Category

In the recent days, we all are facing the hacking issue at that time, we always see problem like account termination from the serve at that time, we can use the following log file to investigate the issue as its providing when hosting account was created, owner changed or account deleted from the server.

For example we are checking logs for the domain test123.com and as per the following logs the hosting account for domain test123.com is created by using the root owner on dated Wed Jan 11 08:19:40 2012 and onwership is under root

root@linux7802 [~]# cat /var/cpanel/accounting.log | grep test123.com
Wed Jan 11 08:19:40 2012:CREATE:root:root:test123.com:115.124.103.126:admin111


Now we have changed the ownership for the domain test123.com hosting account to linux780 reseller ownership therefore check the following logs

root@linux7802 [~]# cat /var/cpanel/accounting.log | grep test123.com 
Wed Jan 11 08:22:51 2012:CHANGEOWNER:root:root:test123.com:admin111:root:linux780

Now we have terminated the hosting account for the domain test123.com by using the root user and its also recorded in the accounting.log

root@linux7802 [~]# cat /var/cpanel/accounting.log | grep test123.com
Wed Jan 11 08:25:14 2012:REMOVE:root:root:test123.com:admin111

So we can similarly check the logs for all the domains when they have created/modified or removed from the server and its always to better to maintain the accounting.log for future reference.