Answers.Body: <p>There is an extension which will record exports using civicrm export from contact search. Unless you have this extension installed there really isn't a way to see if there were specific exports of information.</p>
  
  <p>More information on the extension can be found <a href="https://github.com/australiangreens/au.org.greens.logexport" rel="nofollow noreferrer">here</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-04-28T06:11:08.227Z
Answers.LastActivityDate: 2020-04-28T06:11:08.227Z
Answers.UserDisplayName: Parvez Saleh
Answers.Body: <p>Specifically for "what records have they exported", I don't think there's an easy answer to that one. Most sites, not just civi, don't track <em>outbound</em> data.</p>
  
  <p>The more general question is more of a web hosting question. For drupal specifically if you have the built-in statistics module enabled you can go to /admin/reports/hits and mostly see what pages they viewed.</p>
  
  <p>For any CMS to get a full list you'd need to look at the web server logs and then look at timestamps. But again that's only <em>inbound</em> data, i.e. what they clicked on, not the actual data they viewed or downloaded. But you could see if they visited an export page.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-04-28T05:59:32.107Z
Answers.LastActivityDate: 2020-04-28T05:59:32.107Z
Answers.UserDisplayName: Demerit
Body: <p>Overarching question - Is there a way to see the actions that a specific user has performed?  For example, is there a way to see what records a user has exported?</p>
  
  <p>Details - We recently had an employee succumb to a phishing attack.  The employee provided a username and password that could be used to access Civi.  While we think that we were able to catch the problem before anything suspicious happened, we would still like to see what this user (or someone pretending to be the user) did while in Civi.  We are specifically concerned about any downloaded information.  We are running Civi 5.24.5 and our website is using Drupal 7.</p>
  
Tags: <logs><logging><db-logging>
Title: Action Records for Civi
ThreadText: # Action Records for Civi
  
  (Asked by: username_0 on 2020-04-28)
  
  Overarching question - Is there a way to see the actions that a specific user has performed? For example, is there a way to see what records a user has exported?
  
  Details - We recently had an employee succumb to a phishing attack. The employee provided a username and password that could be used to access Civi. While we think that we were able to catch the problem before anything suspicious happened, we would still like to see what this user (or someone pretending to be the user) did while in Civi. We are specifically concerned about any downloaded information. We are running Civi 5.24.5 and our website is using Drupal 7.
  
  **Tags:** logs, logging, db-logging
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2020-04-28. Score: 1
  
  There is an extension which will record exports using civicrm export from contact search. Unless you have this extension installed there really isn't a way to see if there were specific exports of information.
  
  More information on the extension can be found [here](https://github.com/australiangreens/au.org.greens.logexport)
  
  
  ---
  
  ### Answer by username_2 on 2020-04-28. Score: 0
  
  Specifically for "what records have they exported", I don't think there's an easy answer to that one. Most sites, not just civi, don't track *outbound* data.
  
  The more general question is more of a web hosting question. For drupal specifically if you have the built-in statistics module enabled you can go to /admin/reports/hits and mostly see what pages they viewed.
  
  For any CMS to get a full list you'd need to look at the web server logs and then look at timestamps. But again that's only *inbound* data, i.e. what they clicked on, not the actual data they viewed or downloaded. But you could see if they visited an export page.
  
  
  ---
  
  