................................

GET CURRENT CPANEL VERSION:
cat /usr/local/cpanel/version

FIND DATE UPGRADED TO CURRENT VERSION (et al):
grep "11.60.0.13" /var/cpanel/updatelogs/*

CPANEL UPDATE LOGS:
ls -l /var/cpanel/updatelogs/
cat /var/cpanel/updatelogs/update.1477886041.log

LOGS:
ls -lah /var/log/
ls -lah /usr/local/cpanel/logs
ls -lah /usr/local/apache/logs

................................

TOP PROCESSES (CPU AND MEMORY USAGE):
/usr/local/cpanel/bin/dcpumonview

LIST USERS:
find /home -printf "%u\n" | sort -u

MONITOR ALL USERS:
top -c d2

MONITOR SPECIFIC USER:
top -c d2 -u michaelt

STATS FOR A USER PAST SEVERAL DAYS:
domain="modelsigninc.com"; for i in `seq 1 7 `; do let i=$i+1 ; let  k=$i-1 ; let s="$(date +%s) - (k-1)*86400"; let t="$(date +%s) - (k-2)*86400"; echo `date -Idate -d @$s`; /usr/local/cpanel/bin/dcpumonview `date -d @$s +%s` `date -d @$t +%s` | sed -r -e 's@^<tr bgcolor=#[[:xdigit:]]+><td>(.*)</td><td>(.*)</td><td>(.*)</td><td>(.*)</td><td>(.*)</td></tr>$@Account: \1\tDomain: \2\tCPU: \3\tMem: \4\tMySQL: \5@' -e 's@^<tr><td>Top Process</td><td>(.*)</td><td colspan=3>(.*)</td></tr>$@\1 - \2@' | grep $domain -A3 ; done

................................

ERROR LOGS:

tail -500 /usr/local/cpanel/logs/error_log
grep "cpsrvd.pl" /usr/local/cpanel/logs/error_log | tail -500
grep '2015-10-31' /usr/local/cpanel/logs/error_log

tail -500 /usr/local/apache/logs/error_log

................................

LOGIN FAILURE DAEMON:
tail -500 /var/log/lfd.log
grep "216.67.172.242" /var/log/lfd.log
grep "^Oct 31" /var/log/lfd.log
zgrep "216.67.172.242" /var/log/lfd.log-20161031.gz
zgrep "^Oct 31" /var/log/lfd.log-20161031.gz

SERVICE STATUS LOGS:
grep "^\[2015-10-31" /var/log/chkservd.log
grep "Restarting lfd" /var/log/chkservd.log


SSH LOGINS:
cat /var/log/secure
cat /var/log/secure | grep 'refused connect'
cat /var/log/secure | grep '201.108.8.22'


FAILED LOGIN ATTAMPTS TO cPanel/WHM:
tail -500 /usr/local/cpanel/logs/login_log

ACCOUNT ACCESS LOGS:
ls -lah /home/michaelt/access-logs/
tail -500 /home/michaelt/access-logs/blog.wyorock.com

CPANEL ACCESS LOGS AND USER ACTIONS:
tail -500 /usr/local/cpanel/logs/access_log
grep "judy" /usr/local/cpanel/logs/access_log

suPHP APACHE MODULE AUDIT LOGS:
tail -50 /usr/local/apache/logs/suphp_log


LOGIN ATTEMPTS TO THE CPSRVD DAEMON:
tail -50 /usr/local/cpanel/logs/login_log


................................