DirectAdmin Locations of Logs

These are the locations of common logs on DirectAdmin servers – accessing these logs will require root SSH access.

DirectAdmin Logs

These are the log files for DirectAdmin itself.

Location	Description
/var/log/directadmin/error.log	General errors for DirectAdmin's service (directadmin.service)
/var/log/directadmin/errortaskq.log	DirectAdmin's internal task queue errors
/var/log/directadmin/system.log	System-service reloads, quota tallies, Let's Encrypt status, etc. are logged here
/var/log/directadmin/login.log	Admin, Reseller, and User level successful and failed logins to the panel
/var/log/directadmin/security.log	Execution of DirectAdmin's plugins

Apache (webserver) Logs

Apache is the default webserver on DirectAdmin servers. {domain.tld} refers to the domain in question – if you are looking for the general logs for my-cool-site.com, they would be located at /var/log/httpd/domains/my-cool-site.com.log .

Because LiteSpeed Enterprise Webserver is a drop-in replacement for Apache, LiteSpeed uses Apache's logs / logfile locations for it's own logs as well.

Location	Description
/var/log/httpd/error_log	General Apache Error Logs
/var/log/httpd/access_log	General Access Logs
/var/log/httpd/suexec_log	SuEXEC Logs
/var/log/httpd/fpexec_log	FpExec1) Logs
/var/log/httpd/domains/{domain.tld}.log	Domain-Specific Access Logs
/var/log/httpd/domains/{domain.tld}.error.log	Domain-Specific Error Logs

CustomBuild

CustomBuild is used on DirectAdmin servers to build Apache, PHP, Exim, Dovecot, etc. Installations, removals, updates, and other calls to CustomBuild (i.e. rewriting/updating configuration files) are logged. It's log location is below:

Location	Description
/usr/local/directadmin/custombuild/custombuild.log	Log of installations (etc.) through CustomBuild

PHP-FPM Logs

If PHP-FPM is in use, it's logs can be found in the locations below for the various versions of PHP installed on the server.

Location	Description
/usr/local/phpXX/var/log/php-fpm.log	PHP-FPM logs: each version of PHP will have it's own logs. See example below.
/usr/local/php73/var/log/php-fpm.log	PHP-FPM logs for PHP 7.3
/var/log/php-fpm73.log	This is a symbolic link to the above file – useful as a shortcut!

Nginx Logs

If Nginx is installed and in-use as a reverse-proxy or as the primary webserver, it's logs will be found in the locations below.

Location	Description
/var/log/nginx/access_log	General Nginx access logs
/var/log/nginx/error_log	General Nginx error logs
/var/log/nginx/modsec_audit.log	ModSecurity rule-processing2)
/var/log/nginx/domains/{domain.tld}.log	Nginx logs for specific domains are logged on this path
/var/log/nginx/domains/{domain.tld}.error.log	Nginx error logs for specific domains are logged on this path

FTP Logs

PureFTPd is the default FTP server on DirectAdmin, and ProFTP is available.

Location	Description
/var/log/messages	General FTPd errors are logged in the system's main log
/var/log/pureftpd.log	PureFTPd general logs
/var/log/proftpd/access.log	If ProFTP is installed, this is where general access is logged
/var/log/proftpd/auth.log	If ProFTP is installed, this is where login attempts are logged

Dovecot (POP3 & IMAP) Logs

Dovecot is the POP3/IMAP server, and also handles local mail delivery3) once email has been received from Exim.

Location
/var/log/maillog	POP3/IMAP logins
var/log/dovecot-lmtp.log	Delivery of emails to local accounts
/var/log/dovecot-lmtp-errors.log	Errors with delivery of local email (i.e. mailbox is over quota)

Exim (SMTP) Logs

Exim is the SMTP server and Mail Transfer Agent4) on DirectAdmin servers.

Location	Description
/var/log/exim/mainlog	Main delivery and receipt log
/var/log/exim/paniclog	Unexpected/Fatal error log
/var/log/exim/processlog	Process logs
/var/log/exim/rejectlog	Incoming-email Rejection logs

NameD (DNS) Logs

The internet-standard BIND is DirectAdmin's DNS server – it is commonly referred to by the system's name named.

Location	Description
/var/log/messages	BIND (named.service) logs to the main system log

Cron Logs

Cron jobs are executed by the cron daemon, and it's log location is listed below.

Location	Description
/var/log/cron	Cron daemon logs

MySQL / MariaDB Logs

By default, only the MySQL / MariaDB general error log is enabled to reduce overhead. Replace {SERVERS_HOSTNAME} with the hostname of your server. The general logs and slow-query logs can be enabled from a root MySQL session.

Location	Description
/var/lib/mysql/{SERVERS_HOSTNAME}.err	MySQL startup and error log