Answers.Body: <p>The short answer would be &quot;no&quot; since CiviCRM is not responsible for authentication, the CMS is.</p>
  <p>CiviCRM can be configured with various levels of logging, but as a general strategy, you'll want to make use of multiple tools when investigating security issues, which will depend on your individual setup.</p>
  <p>For the specific issue of 'theft of user information', there is an extension that prevents administrators from downloading contact data unless given explicit permission, you might want your organization to use that going forward.</p>
  <p>Other than that, if it's a bunch of data that was downloaded, then I'd comb the webserver logs for large downloads, find the originating ip and then look for matching login urls with the same ip.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-12-02T18:44:20.383Z
Answers.Text: https://civicrm.org/extensions/export-permission
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-12-02T15:27:41.720Z
Answers.LastActivityDate: 2020-12-02T15:27:41.720Z
Answers.UserDisplayName: Alan Dixon
Body: <p>I need a log of user actions due to a security breach (theft of User Information). However, according to my knowledge and research, CiviCRM does not have such a feature.</p>
  <p>How can I access a user's <strong>User Actions Log</strong> data in <strong>CiviCRM</strong>. The information I want is as follows. Whenever the user logged into the system, opened a new individual and activity record, and made a search, what is the IP address of my site. Like. There is a feature like this in Joomla but I can't use it either. I wrote the reason in the Joomla form. I think he should keep a diary like this for security breaches and similar issues. The system below is used by Joomlan. Is it possible to adapt this for CiviCRM? Can you help me with this.</p>
  <p><a href="https://i.sstatic.net/VP5el.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/VP5el.png" alt="enter image description here" /></a></p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-12-01T16:25:01.797Z
Comments.Text: The closest thing is trigger-based logging under Admin - System Settings - Misc - Logging. But it doesn't track view actions. You'd need to combine several sources like the civi logging, the joomla logs, and the webserver logs to see all the http requests.
Comments.UserDisplayName: Demerit
Tags: <joomla><user-account><logs>
Title: Is there a CiviCRM User Actions Log Feature?
ThreadText: # Is there a CiviCRM User Actions Log Feature?
  
  (Asked by: username_0 on 2020-12-01)
  
  I need a log of user actions due to a security breach (theft of User Information). However, according to my knowledge and research, CiviCRM does not have such a feature.
  
  How can I access a user's **User Actions Log** data in **CiviCRM**. The information I want is as follows. Whenever the user logged into the system, opened a new individual and activity record, and made a search, what is the IP address of my site. Like. There is a feature like this in Joomla but I can't use it either. I wrote the reason in the Joomla form. I think he should keep a diary like this for security breaches and similar issues. The system below is used by Joomlan. Is it possible to adapt this for CiviCRM? Can you help me with this.
  
  [![enter image description here](https://i.sstatic.net/VP5el.png)](https://i.sstatic.net/VP5el.png)
  
  **Tags:** joomla, user-account, logs
  
  > **Comments:**
  > **username_1**: The closest thing is trigger-based logging under Admin - System Settings - Misc - Logging. But it doesn't track view actions. You'd need to combine several sources like the civi logging, the joomla logs, and the webserver logs to see all the http requests.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2020-12-02. Score: 1 | Accepted answer
  
  The short answer would be "no" since CiviCRM is not responsible for authentication, the CMS is.
  
  CiviCRM can be configured with various levels of logging, but as a general strategy, you'll want to make use of multiple tools when investigating security issues, which will depend on your individual setup.
  
  For the specific issue of 'theft of user information', there is an extension that prevents administrators from downloading contact data unless given explicit permission, you might want your organization to use that going forward.
  
  Other than that, if it's a bunch of data that was downloaded, then I'd comb the webserver logs for large downloads, find the originating ip and then look for matching login urls with the same ip.
  
  > **Comments:**
  > **username_3**: https://civicrm.org/extensions/export-permission  
  
  ---
  
  