You will find this information in Cpanels raw access logs.
View the FTP logs
If you need to see who has accessed your site with FTP, you can view
this information in the raw access log files for your website.
You can download these log files from the cPanel Raw Access Logs
screen. FTP logs will include ftp_log in the filename.
PICK Important: Before you can access these logs, you must navigate to
the Raw Access Logs interface and select Archive logs in your home
directory at the end of each stats run. The logs will be available
after the system processes them.
Download and View Your Raw Access Logs
This section lists the domains on your account along with log
Domain — Each domain on your account is listed here. To access a domain's raw access log:
- Click the desired link to download that domain's raw access log.
- The log file will automatically download to your computer.
- Unzip the file to view it.
Last Update — The last date that the log file was updated.
Disk Usage — The amount of disk space used by the log file.
Linked Domains — The domains parked on top of the domain listed.
This section lists the archived logs contained in your /home directory.
Click the filename to download an archived log. You can also open the file in your /home/username directory. You can access the access-logs file in the command line with a text editor.
Note: If you do not have any archived log files, no files are listed in this section.
It's also worth mentioning that some hosts use different formatting and even separate the raw access logs into more manageable files, you should really be asking your host for additional information since 1. its what you pay them for, and 2. files that are separated using a filter are easier to find what your looking for.