CiviCRM Stack Exchange is a question and answer site for administrators and users of the CiviCRM Constituent Relationship Management software. It only takes a minute to sign up.
Sign up to join this community
It seems as though one of the members of my organization has used their access to our contact information in a way that they shouldn't have. I've been tasked with proving that they searched for, and accessed the email addresses of contacts and then copied or exported this information.
Is it possible to find a record of "who searched what" in drupal CiviCRM? I am open to either using the interface or mysql backend directly.
CiviCRM does not store information of who accessed what, for better and worse.
If you have the advanced logging turned on, you can see changes users made. The CMS may have a record of when they last accessed the site, if that's helpful. There's also an extension that adds a permission to restrict exports. While any of those might be helpful, none are what you're looking for, because it doesn't exist - sorry!
While there isn't a way to do it using native Civicrm - you might be able to get close using webserver logs - depends on how your server is set up and if they are still available for the time period concerned, and if the person was accessing the site from a location that no other users were, or will be identifiable by their user agent in combination with IP address. If they are using the same browser as everyone else and have done this on site then this solution isn't going to work.
Assuming your webserver logs ip address and uri (including parameters), and that the person accessing it is going to be identifiable via a unique IP address, or user agent or combination.
If it is recent you could use check the drupal watchdog table to look for ip addresses associated with the user. Then depending on what information is in your webserver you could use that to identify which requests have been made by that user.
If your webserver logs contain the full uri - including url parameters - then you should be able to filter down on pages at /civicrm/ (Assumming there is no ability to view/export contacts via drupal views). Specific types of pages in civi have the same base uri - with different parameters for different records. Run the steps you are looking for then look in the log to identify what shows.
