cPanel/WHM reseller monitoring: what you get
A reseller is not a server but an index of accounts. We query WHM with your token, add one host per account we find and watch what changes: accounts, quotas, domains, traffic.
- an API token from WHM
- accounts every 30 min, domains hourly
What you get
What you install
Nothing on the server: an API token from WHM, saved in the dashboard. You can then install the agent on the accounts, through WHM, with one command.
What it sees inside
Through WHM: the server version and load, the accounts (added, removed, suspended), quotas, shell, plan, IP, held mail, API tokens, the 2FA policy and a sample of the traffic of accounts without an agent.
What it sees from outside
Each account’s domain, once an hour: delegated, expired or moved to another server. Every account whose domain is delegated gets the ten outside checks of shared hosting.
What alerts you
An account added or removed, a shell granted to an account, mail held by cPanel, a quota above 98%, a WHM that does not answer, high load, a domain moved to another server or re-registered by someone else, web campaigns on accounts.
What it can fix
On the reseller itself, none. On every account with an agent, quarantine of infected files, as on shared hosting.
What it cannot see
What happens inside the accounts: files, cron, complete logs. For that you install the agent in the account itself, and the account becomes a shared hosting host. Discovered accounts do not use hosts from your plan; an account with probes or an agent uses one.
What you see in the dashboard
The reseller page has the Overview, Availability, Server, Accounts, Checks and Activity tabs; each account then has its own shared hosting page.
How it counts against your plan
The WHM uses one host. Discovered accounts use nothing; an account with probes or an agent uses one host. When the plan is full, new accounts stay discovered, without probes.
The full list, row by row
Each row says how often it looks, what it compares and what it does: alerts you, shows only on the host page, or is a remediation you approve.
the server
- cPanel version and load average (every 10 min) [alerts you]: A changed version and sustained load (warning from 15, critical from 30), as a signal of noisy neighbors on the server you resell. A WHM that does not answer is a critical incident.
- API tokens and the 2FA policy (every 6 h) [on the host page]: A new API token is the key with which someone can do from outside everything you do from WHM: the check turns critical on the host page and in the score. 2FA not being mandatory is noted. It sends no alert.
- Web traffic of the accounts without an agent (every 5 min) [alerts you]: Through WHM we read a sample of the recent visitors of the accounts that have no agent yet, up to 20 accounts per run. They feed the same web attack detector as the agent logs, so a sustained campaign opens an incident here too.
the accounts
- Accounts added, removed or suspended (every 30 min) [alerts you]: A diff against the previous inventory. An account added or removed opens an incident; one suspended or reactivated is noted. A deleted or suspended account pauses its site probes, and they start again when it is reactivated.
- Disk quotas, per account (every 30 min) [alerts you]: A warning on the host page from 90%, a critical incident from 98%. Quotas come from WHM as suffixed text, “698M” or “1.2G”; we convert them explicitly, because naive parsing reports a full account at 0.13% usage.
- Shell, plan, IP and mail hold (every 30 min) [alerts you]: A shell granted to an account and mail held by cPanel are a critical incident: cPanel sets the hold flag itself when an account exceeds its mail rate, so it is the verdict of the server that sees the send queue. A changed IP or plan is a warning.
- The agent on new accounts (every 30 min): You can install the agent on every unenrolled account with one command, or let new accounts enroll themselves as they appear, within your plan’s host limit. Installing through WHM needs cPanel API rights on the token, not just account listing. Accounts already reporting are skipped rather than reinstalled.
the domains
- Expired domain or withdrawn delegation (every hour) [on the host page]: The account stays on the server, with files and mail, but the domain no longer resolves anywhere. From WHM it is invisible: the listing shows it as healthy as any other. It shows on the host page; the account gets no probes while the domain is not delegated.
- Domain answering from elsewhere, or re-registered (every hour) [alerts you]: The delegation moved, but the account is still yours: a warning incident, and you can mark the account “not mine anymore”. A domain registered again by someone else after the account was created is a critical incident.
on one real reseller: seven of nine domains were no longer delegated and one answered from another server, while in WHM all nine looked equally healthy
How to start
- In WHM, create an API token. The minimum is the list-accts privilege, enough for accounts and their sites.
- In the dashboard pick “Add a host”, type “cPanel/WHM reseller”, with the WHM address, and save the token.
- The accounts appear as hosts at the first sync (every 30 minutes), and those with a delegated domain get probes.
- Optional: install the agent on every account with one command, or let new accounts enroll themselves.
Questions about this host type
What privileges does the WHM token need?
For accounts and their sites, list-accts is enough. API tokens, the 2FA policy, account traffic and installing the agent through WHM need more (access to the accounts’ cPanel API); without it, those checks show as “unknown”, not “clean”.
How many hosts does a reseller use?
One for the WHM, plus one for each account that gets probes or an agent. Accounts that are only discovered are not counted. When the plan is full, new accounts stay discovered and you get a warning on the host page.
Can I install the agent on every account at once?
Yes, with one command, or you can let new accounts enroll themselves as they appear, within your plan. Accounts already reporting are skipped.
What happens when I suspend or delete an account?
The account’s probes pause, so a suspended account does not show as “down”. When reactivated they start again. Deleting an account opens an incident, because an account gone without you knowing matters as much as one that appeared.