The user audit log #

The user audit log answers one question for any account of the site: who did what to it, when and from where, and who tried and was refused. Use it after an editor managed members, when someone asks why their account changed, when a sign-in looks suspicious, or to review new accounts and role changes.

It lists one line per event about a user account or a user group, from every interface: the administration, the Editor, the public site, the REST interface and the commands.

Open it #

In the administration, click Users in the top menu, then User audit log in the left column (the address is https://www.example.com/admin/user/audit). The page needs the permission user/audit: administrators have it. Whoever holds it sees the events of every account, so give it only to roles that should, for example a role with user/audit alone for a data protection officer.

What a line shows #

Passwords, password hashes, tokens and other secrets are never recorded.

What is recorded #

• an account created, changed, moved, enabled, disabled, locked, unlocked or removed, and its e-mail address or username changed;
• a password changed or reset, and a reset requested (never the password itself);
• a registration waiting for approval, approved or denied, and a new editor's account approved or denied;
• a role assigned to or taken from an account or a group;
• sign-ins, failed sign-ins, sign-outs, Verify it's you and ended sessions; passkeys added or used;
• every refused attempt, for example an editor trying to edit an administrator's account.

So the work of member management is covered: what an editor did to a member, and every time an editor reached for an account they may not change.

Narrow the list #

Under Narrow the list:

1. User: a username or a user ID. It finds the events about that account and the events that user caused, so one search shows both what happened to a member and what an editor did. Clicking a username in the list searches for it.
2. Action: one event, or a branch of them: access.user finds every access.user.* event.
3. Result: Any result, Done, Refused or Failed.
4. From and To: days, both included.
5. Press Show; Clear removes the filters.

In the list, the username under Account or By is a link: it shows every event of that account.

Export #

Export the list as CSV downloads the whole filtered list (one line per event, before and after as JSON), for a review or a request for information. The export itself is recorded. Treat the file like the data it contains: it names people and what they did.

How long events are kept #

The page says how long: by default 730 days. The cronjob part useraudit (in the infrequent group) removes older lines (settings/audit.ini [UserAuditSettings] RetentionDays). The audit files of the site keep their own copy with their own retention.

Example #

A member says their e-mail address was changed without their knowledge. Open the user audit log, enter the member's username under User, choose the action access.user.email.change and press Show. The line names the editor who changed it, when, and from the Editor; a search for that editor's username then shows what else they did that day.

When the page is missing or empty #

From the console #

./console exp:user:audit <user> lists the same rows for one account, filtered by event, result and dates, also as JSON for scripts. See Audit and hygiene.

Related pages #

• Managing members
• Setting up accounts for editors and administrators
• How do I find out who changed what?, for content
• Security and audit
• User audit log, the technical description with every setting
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.