Directadmin logs are saved as below:
DirectAdmin Locations of Logs
These are the locations of common logs on DirectAdmin servers – accessing these logs will require root SSH access.
DirectAdmin Logs
These are the log files for DirectAdmin itself.
| Location | Description |
|---|
| /var/log/directadmin/error.log | General errors for DirectAdmin's service (directadmin.service) |
| /var/log/directadmin/errortaskq.log | DirectAdmin's internal task queue errors |
| /var/log/directadmin/system.log | System-service reloads, quota tallies, Let's Encrypt status, etc. are logged here |
| /var/log/directadmin/login.log | Admin, Reseller, and User level successful and failed logins to the panel |
| /var/log/directadmin/security.log | Execution of DirectAdmin's plugins |
Apache (webserver) Logs
Apache is the default webserver on DirectAdmin servers.
{domain.tld} refers to the domain in question – if you are looking for the general logs for my-cool-site.com, they would be located at /var/log/httpd/domains/my-cool-site.com.log .
Because LiteSpeed Enterprise Webserver is a drop-in replacement for Apache, LiteSpeed uses Apache's logs / logfile locations for it's own logs as well.
| Location | Description |
|---|
| /var/log/httpd/error_log | General Apache Error Logs |
| /var/log/httpd/access_log | General Access Logs |
| /var/log/httpd/suexec_log | SuEXEC Logs |
| /var/log/httpd/fpexec_log | FpExec1) Logs |
| /var/log/httpd/domains/{domain.tld}.log | Domain-Specific Access Logs |
| /var/log/httpd/domains/{domain.tld}.error.log | Domain-Specific Error Logs |
CustomBuild
CustomBuild is used on DirectAdmin servers to build Apache, PHP, Exim, Dovecot, etc. Installations, removals, updates, and other calls to CustomBuild (i.e. rewriting/updating configuration files) are logged. It's log location is below:
| Location | Description |
|---|
| /usr/local/directadmin/custombuild/custombuild.log | Log of installations (etc.) through CustomBuild |
PHP-FPM Logs
If PHP-FPM is in use, it's logs can be found in the locations below for the various versions of PHP installed on the server.
| Location | Description |
|---|
| /usr/local/phpXX/var/log/php-fpm.log | PHP-FPM logs: each version of PHP will have it's own logs. See example below. |
| /usr/local/php73/var/log/php-fpm.log | PHP-FPM logs for PHP 7.3 |
| /var/log/php-fpm73.log | This is a symbolic link to the above file – useful as a shortcut! |
Nginx Logs
If Nginx is installed and in-use as a reverse-proxy or as the primary webserver, it's logs will be found in the locations below.
| Location | Description |
|---|
| /var/log/nginx/access_log | General Nginx access logs |
| /var/log/nginx/error_log | General Nginx error logs |
| /var/log/nginx/modsec_audit.log | ModSecurity rule-processing) |
| /var/log/nginx/domains/{domain.tld}.log | Nginx logs for specific domains are logged on this path |
| /var/log/nginx/domains/{domain.tld}.error.log | Nginx error logs for specific domains are logged on this path |
FTP Logs
PureFTPd is the default FTP server on DirectAdmin, and ProFTP is available.
| Location | Description |
|---|
| /var/log/messages | General FTPd errors are logged in the system's main log |
| /var/log/pureftpd.log | PureFTPd general logs |
| /var/log/proftpd/access.log | If ProFTP is installed, this is where general access is logged |
| /var/log/proftpd/auth.log | If ProFTP is installed, this is where login attempts are logged |
Dovecot (POP3 & IMAP) Logs
Dovecot is the POP3/IMAP server, and also handles local mail delivery
3) once email has been received from Exim.
| Location | |
|---|
| /var/log/maillog | POP3/IMAP logins |
| var/log/dovecot-lmtp.log | Delivery of emails to local accounts |
| /var/log/dovecot-lmtp-errors.log | Errors with delivery of local email (i.e. mailbox is over quota) |
Exim (SMTP) Logs
Exim is the SMTP server and Mail Transfer Agent4) on DirectAdmin servers.
| Location | Description |
|---|
| /var/log/exim/mainlog | Main delivery and receipt log |
| /var/log/exim/paniclog | Unexpected/Fatal error log |
| /var/log/exim/processlog | Process logs |
| /var/log/exim/rejectlog | Incoming-email Rejection logs |
NameD (DNS) Logs
The internet-standard BIND is DirectAdmin's DNS server – it is commonly referred to by the system's name named.
| Location | Description |
|---|
| /var/log/messages | BIND (named.service) logs to the main system log |
Cron Logs
Cron jobs are executed by the cron daemon, and it's log location is listed below.
| Location | Description |
|---|
| /var/log/cron | Cron daemon logs |
MySQL / MariaDB Logs
By default, only the MySQL / MariaDB general error log is enabled to reduce overhead. Replace
{SERVERS_HOSTNAME} with the hostname of your server. The general logs and slow-query logs can be enabled from a root MySQL session.
| Location | Description |
|---|
| /var/lib/mysql/{SERVERS_HOSTNAME}.err | MySQL startup and error log |
ie: echo > /var/log/exim/rejectlog
for each path/directory.
