Webmail Login attempt:
/usr/local/cpanel/logs/login_log
cp /usr/local/cpanel/logs/login_log /home/cpanel_unsername
chmod 644 /home/cpanel_unsername/ogin_log
POP3 login attempts:
/var/log/maillog
cp /usr/local/cpanel/logs/maillog /home/cpanel_unsername
chmod 644 /home/cpanel_unsername/maillog