Overarching question - Is there a way to see the actions that a specific user has performed? For example, is there a way to see what records a user has exported?

Details - We recently had an employee succumb to a phishing attack. The employee provided a username and password that could be used to access Civi. While we think that we were able to catch the problem before anything suspicious happened, we would still like to see what this user (or someone pretending to be the user) did while in Civi. We are specifically concerned about any downloaded information. We are running Civi 5.24.5 and our website is using Drupal 7.

2 Answers 2


There is an extension which will record exports using civicrm export from contact search. Unless you have this extension installed there really isn't a way to see if there were specific exports of information.

More information on the extension can be found here


Specifically for "what records have they exported", I don't think there's an easy answer to that one. Most sites, not just civi, don't track outbound data.

The more general question is more of a web hosting question. For drupal specifically if you have the built-in statistics module enabled you can go to /admin/reports/hits and mostly see what pages they viewed.

For any CMS to get a full list you'd need to look at the web server logs and then look at timestamps. But again that's only inbound data, i.e. what they clicked on, not the actual data they viewed or downloaded. But you could see if they visited an export page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.