Answers.Body: <p>While there isn't a way to do it using native Civicrm - you might be able to get close using webserver logs - depends on how your server is set up and if they are still available for the time period concerned, and if the person was accessing the site from a location that no other users were, or will be identifiable by their user agent in combination with IP address. If they are using the same browser as everyone else and have done this on site then this solution isn't going to work.</p>
  
  <p>Assuming your webserver logs ip address and uri (including parameters), and that the person accessing it is going to be identifiable via a unique IP address, or user agent or combination.</p>
  
  <p>If it is recent you could use check the drupal watchdog table to look for ip addresses associated with the user. Then depending on what information is in your webserver you could use that to identify which requests have been made by that user.</p>
  
  <p>If your webserver logs contain the full uri - including url parameters - then you should be able to filter down on pages at /civicrm/ (Assumming there is no ability to view/export contacts via drupal views). Specific types of pages in civi have the same base uri - with different parameters for different records. Run the steps you are looking for then look in the log to identify what shows.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-05T20:04:40.420Z
Answers.LastActivityDate: 2018-12-05T20:04:40.420Z
Answers.UserDisplayName: Luke Stewart
Answers.Body: <p>CiviCRM does not store information of who accessed what, for better and worse.</p>
  
  <p>If you have the advanced logging turned on, you can see changes users made.  The CMS may have a record of when they last accessed the site, if that's helpful.  There's also an <a href="https://civicrm.stackexchange.com/q/14868/12">extension</a> that adds a permission to restrict exports.  While any of those might be helpful, none are what you're looking for, because it doesn't exist - sorry!</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-05T17:09:11.887Z
Answers.Text: Should I make another post for who viewed what, in place of who searched for what, or would you be able to answer this in the comments?
Answers.UserDisplayName: namgo
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-05T18:38:20.443Z
Answers.Text: Per Jon's comment, Civi does not have the capacity to store data about who viewed what in the database.
Answers.UserDisplayName: Lesley Carter - BackOffice
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-05T22:07:48.003Z
Answers.Text: It should be possible to implement this as a feature in an extension - definitely for exports saving the user, timestamp + query and/or list of contact ids exported + and number of rows would be a great start. Having a copy of the file on hand might require too much space - and additional issues when you think about GDPR compliance etc.
Answers.UserDisplayName: Luke Stewart
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-05T16:38:51.943Z
Answers.LastActivityDate: 2018-12-05T16:38:51.943Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>It seems as though one of the members of my organization has used their access to our contact information in a way that they shouldn't have. I've been tasked with proving that they searched for, and accessed the email addresses of contacts and then copied or exported this information.</p>
  
  <p>Is it possible to find a record of "who searched what" in drupal CiviCRM? I am open to either using the interface or mysql backend directly.</p>
  
Tags: <search>
Title: Accessing a user's search history
ThreadText: # Accessing a user's search history
  
  (Asked by: username_0 on 2018-12-05)
  
  It seems as though one of the members of my organization has used their access to our contact information in a way that they shouldn't have. I've been tasked with proving that they searched for, and accessed the email addresses of contacts and then copied or exported this information.
  
  Is it possible to find a record of "who searched what" in drupal CiviCRM? I am open to either using the interface or mysql backend directly.
  
  **Tags:** search
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2018-12-05. Score: 6 | Accepted answer
  
  CiviCRM does not store information of who accessed what, for better and worse.
  
  If you have the advanced logging turned on, you can see changes users made. The CMS may have a record of when they last accessed the site, if that's helpful. There's also an [extension](https://civicrm.stackexchange.com/q/14868/12) that adds a permission to restrict exports. While any of those might be helpful, none are what you're looking for, because it doesn't exist - sorry!
  
  > **Comments:**
  > **username_0**: Should I make another post for who viewed what, in place of who searched for what, or would you be able to answer this in the comments?  
  > **username_3**: Per Jon's comment, Civi does not have the capacity to store data about who viewed what in the database.  
  > **username_1**: It should be possible to implement this as a feature in an extension - definitely for exports saving the user, timestamp + query and/or list of contact ids exported + and number of rows would be a great start. Having a copy of the file on hand might require too much space - and additional issues when you think about GDPR compliance etc.  
  
  ---
  
  ### Answer by username_1 on 2018-12-05. Score: 4
  
  While there isn't a way to do it using native Civicrm - you might be able to get close using webserver logs - depends on how your server is set up and if they are still available for the time period concerned, and if the person was accessing the site from a location that no other users were, or will be identifiable by their user agent in combination with IP address. If they are using the same browser as everyone else and have done this on site then this solution isn't going to work.
  
  Assuming your webserver logs ip address and uri (including parameters), and that the person accessing it is going to be identifiable via a unique IP address, or user agent or combination.
  
  If it is recent you could use check the drupal watchdog table to look for ip addresses associated with the user. Then depending on what information is in your webserver you could use that to identify which requests have been made by that user.
  
  If your webserver logs contain the full uri - including url parameters - then you should be able to filter down on pages at /civicrm/ (Assumming there is no ability to view/export contacts via drupal views). Specific types of pages in civi have the same base uri - with different parameters for different records. Run the steps you are looking for then look in the log to identify what shows.
  
  
  ---
  
  