diff --git a/install.sh b/install.sh
index 51ad7a7..f542d05 100755
--- a/install.sh
+++ b/install.sh
@@ -180,10 +180,30 @@ if [ "$HAS_APACHE" -eq 1 ] && [ -z "$APACHE_LOG" ]; then
             /var/log/apache2/other_vhosts_access.log /var/log/httpd/access.log; do
     [ -r "$_p" ] && { APACHE_LOG="$_p"; break; }
   done
-  # Panel-Hoster (KeyHelp, Plesk, cPanel) legen PRO DOMAIN eigene Logs an.
-  # Dann reicht der globale Pfad nicht — Glob deckt alle VHosts ab.
+  # Panel-Hoster legen PRO DOMAIN eigene Logs an, oft ZWEISTUFIG
+  # (<user>/logs/<domain>/access.log). Ein einstufiges Glob trifft das nicht.
+  # Muster je Panel — die reale Struktur wurde auf x22 (KeyHelp) verifiziert:
+  #   KeyHelp : /home/users/<user>/logs/<domain>/access.log
+  #   Plesk   : /var/www/vhosts/<domain>/logs/access_log
+  #   cPanel  : /usr/local/apache/domlogs/<domain>  (bzw. /home/<user>/logs)
   if [ -z "$APACHE_LOG" ]; then
-    for _d in /var/log/apache2 /var/log/httpd /home/*/logs /var/log/keyhelp; do
+    for _pat in \
+      "/home/users/*/logs/*/access.log" \
+      "/var/www/vhosts/*/logs/access_log" \
+      "/usr/local/apache/domlogs/*" \
+      "/home/*/logs/*/access.log" \
+      "/var/log/apache2/*access*.log" \
+      "/var/log/httpd/*access*.log"; do
+      # shellcheck disable=SC2086
+      if ls $_pat >/dev/null 2>&1; then
+        APACHE_LOG="$_pat"
+        break
+      fi
+    done
+  fi
+  # Einzelne, flache Faelle weiterhin abdecken
+  if [ -z "$APACHE_LOG" ]; then
+    for _d in /var/log/apache2 /var/log/httpd; do
       [ -d "$_d" ] || continue
       if ls "$_d"/*access*.log "$_d"/access_log >/dev/null 2>&1; then
         APACHE_LOG="$_d/*access*.log"