I need a log of user actions due to a security breach (theft of User Information). However, according to my knowledge and research, CiviCRM does not have such a feature.

How can I access a user's User Actions Log data in CiviCRM. The information I want is as follows. Whenever the user logged into the system, opened a new individual and activity record, and made a search, what is the IP address of my site. Like. There is a feature like this in Joomla but I can't use it either. I wrote the reason in the Joomla form. I think he should keep a diary like this for security breaches and similar issues. The system below is used by Joomlan. Is it possible to adapt this for CiviCRM? Can you help me with this.

enter image description here

  • 1
    The closest thing is trigger-based logging under Admin - System Settings - Misc - Logging. But it doesn't track view actions. You'd need to combine several sources like the civi logging, the joomla logs, and the webserver logs to see all the http requests.
    – Demerit
    Commented Dec 1, 2020 at 16:25

1 Answer 1


The short answer would be "no" since CiviCRM is not responsible for authentication, the CMS is.

CiviCRM can be configured with various levels of logging, but as a general strategy, you'll want to make use of multiple tools when investigating security issues, which will depend on your individual setup.

For the specific issue of 'theft of user information', there is an extension that prevents administrators from downloading contact data unless given explicit permission, you might want your organization to use that going forward.

Other than that, if it's a bunch of data that was downloaded, then I'd comb the webserver logs for large downloads, find the originating ip and then look for matching login urls with the same ip.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.