Hi,

You can download raw FTP logs via WHM or cPanel interface where you could find the info who logged in, from which IP and what uploaded or downloaded by FTP. The same info can be found in /var/log/messages* files accessible via shell or SFTP for root user. The listing of session times for users is available as output of "last" command in shell. You may redirect the output to file and then download the file by SFTP or FTP, if you put the file under one of cPanel accounts. The command with redirect would be "last > /path/to/file".

Hi Peter,

All domain related logs get cleared after each "stats run" by default. "Stats run" means periodical log processing by configured stats programs such as Webalizer and Analog and logs archiving under home folder of the account if this was activated in "Raw Log Manager" in cPanel for it. If logs archiving is not activated for an account, all account logs will be wiped out after stats run (again, this is the default behavior).

Logs processing settings are server-wide and can be configured under Stats and Logs section of Tweak Settings in WHM. There is no log size limit. Logs contain information for all the period since the last stats run. Please note that the time between processing logs may differ due to the number of logs to process and average server load. This can be fixed by setting "The load average above the number of cpus at which logs file processing should be suspended"  to a value higher than the average load on your server.

I hope this helps.

Hi Peter,

People frequently confuse "Server Load" and "CPU usage". What you described is "CPU usage" and it is measured in percents because it is not possible to use CPUs more than they are supposed for.

The term "Server Load" indicates a rough idea of the number of running queued processes waiting for a resource to become available. CPUs are usually this resource. Please note that "Server Load" does not accurately depict how busy your system is in that very moment, or why it is busy in general. Multiprocessor systems can easily handle the "Server load" of 10, whereas such load may slow down a single processor system significantly. "Server Load" averages for the past 1, 5 and 15 minutes are  available in he output of the "top" and "uptime" commands in shell.

Hence "8" for the ""The load average above the number of cpus at which logs file processing should be suspended" option means to pause log processing when the load on the server is above 8.

As for the "Number of days between processing log files and bandwidth usage" option, logs processing and bandwidth usage are done by the same program. It is not needed to separate those two actions. The option itself controls the interval between runs of the stats and and bandwidth processing tool called cpanellogd in cPanel.