The following guide was taken from Cpanel support forum. This information is when you need to migrate Cpanel account information from one drive or to another.

Manually moving Cpanel

These commands will allow you to manually migrate all customer data and configs from an old primary drive installed as a slave.

source drive should be mounted to /mnt/slave1

run chkrootkit to make sure you don’t copy back infected files.. chkrootkit — locally checks for signs of a rootkit

now we can start copying back data from the old drive

Run these rSync commands to move everything over:


# rsync -vrplogDtH /slave1/usr/local/apache/conf /usr/local/apache
# rsync -vrplogDtH /slave1/var/named /var
# rsync -vrplogDtH /slave1/home/* /home
# rsync -vrplogDtH /slave1/usr/local/cpanel /usr/local
# rsync -vrplogDtH /slave1/var/lib/mysql /var/lib
# rsync -vrplogDtH /slave1/var/cpanel /var
# rsync -vrplogDtH /slave1/usr/share/ssl /usr/share
# rsync -vrplogDtH /slave1/var/ssl /var
# rsync -vrplogDtH /slave1/usr/local/cpanel/3rdparty/mailman /usr/local/cpanel/3rdparty
# rsync -vrplogDtH /slave1/var/log/bandwidth /var/log
# rsync -vrplogDtH /slave1/usr/local/frontpage /usr/local
# rsync -vrplogDtH /slave1/var/spool/cron /var/spool
# rsync -vrplogDtH /slave1/root/.my.cnf /root
# rsync -vrplogDtH /slave1/etc/httpd/conf/httpd.conf /etc/httpd/conf

* rsync options
-v, –verbose increase verbosity
-r, –recursive recurse into directories
-p, –perms preserve permissions
-l, –links copy symlinks as symlinks
-o, –owner preserve owner (super-user only)
-g, –group preserve group
-D same as –devices –specials
-t, –times preserve modification times
-H, –hard-links preserve hard links

See a list of all the options –

cd to the old etc directory:


#cd /slave1/etc

And copy some files from here:


# rsync -vrplogDtH secondarymx domainalias valiases vfilters exim* proftpd* pure-ftpd* passwd* group* *domain* *named* wwwacct.conf cpupdate.conf quota.conf shadow* *rndc* ips* ipaddrpool* ssl hosts /etc 

Update cpanel afterwards


# /scripts/upcp
# /scripts/updatenow
# /scripts/sysup
# /scripts/fixeverything
# /scripts/exim4
# /scripts/easyapache
# /scripts/securetmp 

Restarting services


# /scripts/restartsrv httpd
# /scripts/restartsrv cpanel
# /scripts/restartsrv mysql
# /scripts/restartsrv named
# /scripts/restartsrv exim 

Source: http://forums.cpanel.net/f49/help-moving-cpanel-accounts-damaged-disk-163734.html

Check the logs:

# nano /var/log messages
PAM-hulk[13813]: Brute force detection active: 580 LOGIN DENIED

Check

cphulkd.log at /usr/local/cpanel/logs


# nano /usr/local/cpanel/logs/login_log
72.177.xxx.xx - root [11/04/2014:05:48:13 -0000] "POST /login/?login_only=1 HTTP/1.1" DEFERRED LOGIN whostmgrd: brute force attempt (user root) has locked out IP 72.177.xxx.xx

First check permission of /usr/local/cpanel/3rdparty/bin/awstats.pl, it should be 755.

Then to update awstats and webalizer run the script :


# /scripts/runweblogs user_nameIf that didn't work try fixwebalizer script :


# /scripts/fixwebalizer

If that doesn’t update stats, then check domlogs of the domain and see if it is up to date. You can use the following script to run statistics :


# /scripts/runstatsonce

If none of the above fixes the issue and the awstats page for the domain is still showing the old date for last update, run the following command :


# /usr/bin/perl /usr/local/cpanel/3rdparty/bin/awstats.pl -config=/home/user_name/tmp/awstats/awstats.domain.com.conf -LogFile=/usr/local/apache/domlogs/domain.com -update

Error

Error: Plugin load for plugin ‘geoipfree’ failed with return code: Error: Can’t locate Geo/IPfree.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 . /usr/local/cpanel/3rdparty/bin/lib /usr/local/cpanel/3rdparty/bin/plugins /usr/local/cpanel/3rdparty/bin/plugins) at (eval 2) line 1.

Cpan

cpan install Geo:IPfree

Other info

Log files at /usr/local/apache/domlogs/domain.com
Config for awstats /home/fl/tmp/awstats/awstats.domain.com.conf
Location of all log files – /home/domain/tmp

If the logs are archived – look here – /home/fl/logs

# cd /home/fl/logs
ls -la
domain.com-Nov-2014.gz
domain.com-Oct-2014.gz

Un archive

# tar -xvzf domain.com-Nov-2014.gz
# ls
domain.com-Nov-2014.log

Unarchive the file and run the command to rebuild it

# /usr/bin/perl /usr/local/cpanel/3rdparty/bin/awstats.pl -config=/home/user_name/tmp/awstats/awstats.domain.com.conf -LogFile=/home/user_name/logs/domain.com-Nov-2014.log -update

Location of cpanel access logs

Apache Logs

General Error and Auditing Logs:
Location : /usr/local/apache/logs/error_log
Description : All exceptions caught by httpd along with standard error output from CGI applications are logged here..
The first place you should look when httpd crashes or you incur errors when accessing website.

Domain Access Logs:
Location : /usr/local/apache/domlogs/domain.com
Description : General access log file for each domain configured with cPanel.

Apache Access Logs:
Location : /usr/local/apache/logs/access_log
Description : Complete web server access log records all requests processed by the server.
MySQL Logs

MySQL General Information and Errors:
Location : /var/lib/mysql/$(hostname).err
Description : This path could vary, but is generally located in /var/lib/mysql. Could also be located at /var/log/mysqld.log

For cPanel/WHM, to enable PDO in the system you can use EasyApache:

1. Login to WHM
2. Click Apache Update
3. Click Start Customizing Based on Profile
4. Select an Apache version
5. Click Next Step
6. Select PHP 5
7. Click Next Step
8. Select a version of PHP 5
9. Click Next Step
10. Click Exhaustive Options List button
11. Scroll down to the check box labeled PDO
12. Click Save and Build

Scenario

WordPress is installed for the primary domain. WordPress is installed for a subdomain. Subdomains set up under the primary domain.

Primary domain – domain.com
Subdomain – demo.domain.com

Issue: demo.domain.com redirects to domain.com/demo or domin.com

Check if there is an .htaccess file in the subdomain directory:

If not, create an .htaccess file and include the following:

# nano /home/domain/public_html/demo/.htaccess
# BEGIN WordPress
RewriteEngine On
RewriteBase /demo/
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /demo/index.php [L]
# END WordPress

If needed…Force www. version of domain to be used

RewriteEngine on
RewriteCond %{HTTP_HOST} ^domain.com [NC]
RewriteRule ^(.*)$ http://www.domain.com/$1 [L,R=301,NC]

Loading a phpinfo file for a domain on a cpanel server, you notice that the “include_path” variable changes.

Resolution:

With PHP PEAR enabled, PEAR is by default configured to include its PHP directory (/home/domina/php in this case). You can disable /home/domain/php from being in the PHP include_path by either removing that directory (/home/freedc/php) or uninstalling PEAR through EasyApache.

Source: https://documentation.cpanel.net/display/1142Docs/Host+Access+Control

You can use the Host Access Control feature to allow or deny clients’ access, based on the IP address, to the following services:
Daemon Name

Service Name
cpaneld cPanel
whostmgrd WHM
webmaild Webmail
cpdavd WebDisk
Allow access for an IP address

To allow an IP address to access a service, perform the following steps:

Enter the service name in the daemon text box. As you type, a list of suggestions will appear.
Enter the IP address or hostname in Access List text box.
You may enter wildcards in this text box.
You cannot enter a range of IP addresses with CIDR notation.
To specify a network range, add /255.255.255.0 to the IP address.
For example, 192.168.0.0/255.255.255.0, where 255.255.255.0 is the desired network mask you want to use.
Enter allow in the Action text box.
Describe the rule in the Comment text box.
Click Save Host Access List.
Click Reload to delete any changes.

Note:
Icon

You can also enter ALL EXCEPT IP address in the Access List text box. When you enter allow as your action, all of the addresses except for the one that you entered in the Access List will be allowed.

For more information on this option, see the Notes and Additional Documentation sections below.
Deny access from an IP address

To deny access to a service from an IP address, perform the following steps:

Enter the service name in the daemon text box. As you type, a list of suggestions will appear.
Enter the IP address or hostname in Access List text box.
You may enter wildcards in this text box.
You cannot enter a range of IP addresses with CIDR notation.
To specify a network range, add /255.255.255.0 to the IP address.
For example 192.168.0.0/255.255.255.0, where 255.255.255.0 is the desired network mask you want to use.
Enter deny in the Action text box.
Describe the rule in the Comment text box.
Click Save Host Access List.
Click Reload to delete any changes.

Note:
Icon

You can also enter ALL EXCEPT IP address in the Access List text box. When you enter deny as your action, all of the addresses except for the one that you entered in the Access List will be denied.

For more information on this option, see the Notes and Additional Documentation sections below.

Warning:
Icon

If you accidentally lock yourself out of WHM when you use Host Access Control, edit the /etc/hosts.allow file through the command line to unlock yourself.
Allow or deny IP addresses manually

For greater host access control flexibility, you can create rules in the command line. To do this, perform the following steps:

Log in to your server as root.
Open the /etc/hosts.allow file with your preferred text editor.
Follow this format: service : IP address : action.
For example: cpaneld : 192.168.0.0 : allow

Note:
Icon

When you configure your firewall directly, you can use CIDR notation.

On a CentOS or Red Hat Enterprise LInux® system, you can use the iptables utility to manage your firewall.

You can block a specific IP address on CentOS with iptables.
For example, to block 192.168.56.210, run the iptables -A INPUT -s 192.168.56.210 -j DROP command.
You can block a specific port for an IP address
For example, to block port 23 on 192.168.56.210, run the iptables -A INPUT -s 192.168.56.210 -p tcp –destination-port 23 -j DROP command.

Note:
Icon

WHM does not use a hosts.deny file. Deny statements should be added to the /etc/hosts.allow file.
Additional notes

You must enter your allow rules before your deny rules. For example, if you choose to allow access for two IP addresses, but you want to deny access from all other addresses, you can do either of the following:

Create two separate rules:
Create one rule that allows 192.168.0.0/255.255.255.0
Create a second rule that denies access to ALL IP addresses.
Create one rule:
Enter all except 192.168.0.0/255.255.255.0 in the Access List text box.
Enter deny in the Action text box.

Additional documentation

cPanel & WHM Application Catalog — This catalog lists utilities that can help you manage access control to your server.
IP Deny Manager — Use this feature to allow or deny access to an individual site.
ProFTPD Configuration for Host Access Control – This document provides the steps to configure FTP daemons to use Host Access Control