📘Check Terminated cPanel Accounts (With Timestamps)

The /var/cpanel/accounting.log contains actions performed on cPanel accounts, including terminations. While the log doesn’t show timestamps by default, we can use stat and ausearch (if auditd is enabled) to correlate deletion times or use logwatch or journalctl for broader system audit trails.

✅ Method 1: Use ls -lt --time=ctime to approximate by file change time

You can get an idea when accounting.log was last changed:

ls -lt --time=ctime /var/cpanel/accounting.log

✅ Method 2: Combine grep with ls or stat for file metadata

Show last 10 terminated accounts with timestamp (basic timestamp from log file modification time):

echo "Last modified: $(stat -c %y /var/cpanel/accounting.log)"
grep REMOVE /var/cpanel/accounting.log | tail -n 10

Note: This doesn’t show individual timestamps per line — only when the log was last changed.

---

🛠️ Method 3: Use ausearch to track account deletions (if auditd is enabled)

If auditd is running, and cPanel user deletions involve system user deletion, you can try:

ausearch -k userdel

Or to get logs for cPanel scripts:

ausearch -x /scripts/removeacct

---

🧰 Method 4: Use logwatch or check journalctl for more detail

Check system logs for account deletion activity:

journalctl | grep removeacct

Or, for systems with logwatch configured:

logwatch --detail high --service cpanel --range today

---

🔁 Proactive Logging (Recommended)

To track account terminations with exact timestamps in the future, consider creating a custom script or using auditd rules:

auditctl -w /var/cpanel/accounting.log -p wa -k cpanel_account_changes

Then check with:

ausearch -k cpanel_account_changes