Default Location of Logs
By default, cPanel places its log files in /usr/local/apache/domlogs/DOMAIN. These logs are split up by domain, which keeps things organised but can make troubleshooting difficult when you need to identify patterns across multiple domains or determine where a specific problem might lie.
The Challenge with Separate Domain Logs
When managing a server with multiple websites, having logs separated by domain creates several challenges:
- You need to check multiple files when troubleshooting server-wide issues
- It’s difficult to identify patterns that might affect several domains
- When investigating suspicious activity, you can’t easily see if it’s targeting multiple sites
- Resource usage analysis becomes more complex
Creating Combined Logs
While combining logs can be done with a bash script that concatenates existing files, this approach is time-consuming and doesn’t provide real-time insight. A more efficient solution is to modify the Apache configuration to create a new combined log file that captures all domain activity in a single location.
Edit Your vhost.default File
For Apache 2.4 (the current version at the time of writing), you’ll need to edit the vhost template file:
nano /var/cpanel/templates/apache2_4/vhost.default
Add the following lines just before the </VirtualHost> tag at the bottom of the file:
LogFormat "%V %a %l %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-agent}i\"" vcommon CustomLog /usr/local/apache/logs/vhost-access_log vcommon
Understanding the Log Format
This configuration creates a custom log format called “vcommon” with the following components:
%V– The server name according to the UseCanonicalName setting%a– Client IP address%l– Remote logname (usually ‘-‘)%u– Remote user if authenticated%t– Time the request was received\"%r\"– First line of request (method, path, protocol)%s– Status code%b– Size of response in bytes\"%{Referer}i\"– Referer header\"%{User-agent}i\"– User-agent header
The %V at the beginning is particularly important as it identifies which domain the log entry is associated with, allowing you to still filter by domain when needed while keeping everything in one file.
Rebuilding the Apache Configuration
To implement these changes, you need to rebuild the Apache configuration and restart the service:
/scripts/verify_vhosts_includes /scripts/rebuildhtpdconf /scripts/restartsrv_httpd
After completing these steps, a new combined log file will be created at /usr/local/apache/logs/vhost-access_log that contains entries from all your domains.
SSL Considerations
If you want to track SSL accesses in the combined log as well, you’ll need to make a similar modification to the SSL vhost template. However, as the author notes, this may not be necessary if you have a limited number of SSL sites, as they tend to stand out more in normal monitoring.
If you do wish to include SSL logs, edit:
nano /var/cpanel/templates/apache2_4/ssl_vhost.default
And add the same LogFormat and CustomLog lines as above.
Log Rotation Considerations
Remember that creating a new log file requires proper log rotation configuration to prevent it from growing too large. This topic will be covered in a future post, but it’s important to implement log rotation for any new log files you create.
A basic approach would be to add an entry to /etc/logrotate.d/apache to ensure your new combined log is rotated alongside the standard Apache logs.
Benefits of Combined Logs
With this configuration in place, troubleshooting becomes significantly easier:
- One file to tail or grep instead of dozens
- Ability to see patterns across multiple domains
- Easier identification of distributed attacks targeting multiple sites
- Simplified log analysis with tools like AWStats or GoAccess
This simple configuration change can save considerable time and effort when managing a multi-domain cPanel server, making it a valuable addition to your server administration toolkit.