[JAY]

CyberPanel Log Files and Config File Locations: Where Everything Lives

When something breaks on a CyberPanel server, the answer is almost always in a log file. The hard part is knowing which one. Here's the map, checked on our CyberPanel 3.0 test server.

Log files
Here are the log files that existed on our fresh server with one website:

Code:Copy

/home/cyber.adminslab.com/logs/cyber.adminslab.com.access_log /home/cyber.adminslab.com/logs/cyber.adminslab.com.error_log /home/cyberpanel/error-logs.txt /usr/local/lscp/logs/access.log /usr/local/lscp/logs/error.log /usr/local/lscp/logs/error.log.2026_10_24 /usr/local/lscp/logs/error.log.2026_10_24.01 /usr/local/lscp/logs/error.log.2026_10_24.02 /usr/local/lscp/logs/error.log.2026_10_24.03 /usr/local/lscp/logs/error.log.2026_10_24.04 /usr/local/lscp/logs/lsrestart.log /usr/local/lscp/logs/stderr.log /usr/local/lsws/logs/access.log /usr/local/lsws/logs/error.log /usr/local/lsws/logs/lsrestart.log /usr/local/lsws/logs/stderr.log /var/log/installLogs.txt

• CyberPanel (the panel itself):
  Code:Copy

  /home/cyberpanel/error-logs.txt
  . Errors from panel actions: creating sites, issuing SSL, backups.
  
• Panel web server (lscpd, port 8090):
  Code:Copy

  /usr/local/lscp/logs/error.log
  and
  Code:Copy

  access.log
  . Older entries move to dated files like
  Code:Copy

  error.log.2026_10_24.01
  (ours had four on install day), so check those too.
  
• OpenLiteSpeed (all websites):
  Code:Copy

  /usr/local/lsws/logs/error.log
  ,
  Code:Copy

  access.log
  ,
  Code:Copy

  stderr.log
  (PHP fatal errors often land here) and
  Code:Copy

  lsrestart.log
  .
  
• One website:
  Code:Copy

  /home/yourdomain.com/logs/yourdomain.com.access_log
  and
  Code:Copy

  .error_log
  .
  
• Installer:
  Code:Copy

  /var/log/installLogs.txt
  . Read it if the install or an upgrade failed.
  
• Mail (Postfix, Dovecot, OpenDKIM): Ubuntu 24.04 had no
  Code:Copy

  /var/log/mail.log
  on our server; use the journal:
  Code:Copy

  journalctl -t postfix/smtp -t postfix/smtpd -t opendkim -n 100
  .
  
• Any service:
  Code:Copy

  journalctl -u mariadb -n 50 --no-pager
  (also
  Code:Copy

  lscpd
  ,
  Code:Copy

  lsws
  ,
  Code:Copy

  pdns
  ,
  Code:Copy

  pure-ftpd-mysql
  ,
  Code:Copy

  dovecot
  ).
  

In the panel, Server has viewers for Access Logs, Error Logs, Email Logs and FTP Logs, and each website has a Logs tab.

Reading logs fast

Code:Copy

tail -f /usr/local/lsws/logs/error.log # watch live, Ctrl+C to stop tail -n 50 /home/cyberpanel/error-logs.txt # last 50 lines grep -i "error" /home/yourdomain.com/logs/*error_log | tail -20 journalctl -u lscpd --since "1 hour ago" --no-pager

Tip: reproduce the problem with

Code:Copy

tail -f

running in a second SSH window. The new lines that appear are the ones that matter.

Config file locations
All checked on our server:

• OpenLiteSpeed main config:
  Code:Copy

  /usr/local/lsws/conf/httpd_config.conf
• A website's virtual host:
  Code:Copy

  /usr/local/lsws/conf/vhosts/yourdomain.com/vhost.conf
  (edit it from the panel: website > Config > vHost Conf)
  
• PHP per version:
  Code:Copy

  /usr/local/lsws/lsphp83/etc/php/8.3/litespeed/php.ini
  (see changing PHP settings)
  
• Website rewrite rules:
  Code:Copy

  /home/yourdomain.com/public_html/.htaccess
• Postfix:
  Code:Copy

  /etc/postfix/main.cf
  ; Dovecot:
  Code:Copy

  /etc/dovecot/dovecot.conf
  ; OpenDKIM:
  Code:Copy

  /etc/opendkim.conf
  and
  Code:Copy

  /etc/opendkim/
• Pure-FTPd:
  Code:Copy

  /etc/pure-ftpd/conf/
  (one setting per file)
  
• PowerDNS:
  Code:Copy

  /etc/powerdns/pdns.conf
• MariaDB:
  Code:Copy

  /etc/mysql/my.cnf
• CyberPanel's own app settings:
  Code:Copy

  /usr/local/CyberCP/CyberCP/settings.py
  (don't edit unless you know why)
  
• Saved passwords:
  Code:Copy

  /etc/cyberpanel/
  (root only; see resetting the admin password)
  

Before you edit a config file

1. Copy it:
   Code:Copy

   cp file file.bak-$(date +%F)
2. Change one thing at a time.
   
3. Restart only the service you touched (
   Code:Copy

   systemctl restart lsws
   ,
   Code:Copy

   postfix
   ...), then check its log.
   
4. CyberPanel regenerates some files (vhost configs, OpenDKIM tables) when you change settings in the panel, so prefer the panel's editors where they exist.
   

More CyberPanel guides

• Fail2ban brute-force protection
  
• Change PHP version per website
  
• Git deployment from GitHub
  
• SSH key login, passwords off
  
• Create a website
  
• Issue SSL and fix failed certificates
  
• Subdomains, addon domains and aliases
  
• Rewrite rules, force HTTPS, HSTS
  
• Install WordPress with LiteSpeed Cache
  
• Cron jobs and a real WP-Cron
  
• Redis object cache for WordPress
  
• Databases and phpMyAdmin
  
• Email, DKIM, SPF and DMARC
  
• Email forwarding, catch-all, plus-addressing
  
• Mail queue, spam senders, blacklists
  
• CyberPanel DNS vs Cloudflare
  
• Packages and website limits
  
• Deploy Laravel on CyberPanel
  
• WordPress staging (clone) fixes
  
• Backups: create, restore, schedule
  
• File Manager and FTP
  
• Reset the admin password from SSH
  
• Check and restart services
  
• First steps after install
  
• ModSecurity + OWASP rules (fix)
  
• CLI cheat sheet
  
• Install CyberPanel on Ubuntu 24.04
  
• Firewall explained
  
• Install PHP extensions
  
• Change PHP settings (php.ini)
  
• Update CyberPanel safely
  
• Server Error (500) after a fresh install
  
• Packages, users and ACLs
  
• Upgrade CyberPanel safely
  
• Real visitor IPs behind Cloudflare
  
• Docker apps on your domain with SSL
  
• Import a large SQL file over SSH
  
• Remote MySQL access for one IP
  
• Move WordPress to CyberPanel by hand
  
• Fix "Error establishing a database connection"
  
• Fix PHP2Shell (CVE-2026-109618/109619)
  
• Run your own nameservers (PowerDNS)
  
• CyberPanel on a small VPS: RAM tuning
  

Tested on CyberPanel 3.0 (build 8, OpenLiteSpeed edition) on Ubuntu 24.04, October 2026. Menu names can change slightly between versions.