Control Panel - forgot password feature

[Zevo]

I've had some targeted attempts to gain access to the Plesk control panel. These attempts are targeting specific users who have access to the control panel for their email. They have requested passwords using the control panel, which are in turn sent to the legit recipient.

My question: is there a log file that would show these requests (not the login itself like you can find in the action log). I'd like to see where these requests are coming from...I suspect a disgruntled employee.

Thanks.

 

[wagnerch]

If you know the approximate time the mails were sent (look at the headers) then you can probably correlate it to an http request in /usr/local/psa/admin/logs/httpsd_access_log