Administration
What to look for in the activity log
Ten minutes a month, and exactly what to look at.
The log records everything, which is why reading all of it is useless. What works is looking at four specific things, once a month.
The four
- Accounts still active for people who have left.
- Bulk downloads: someone taking far more at once than their work requires.
- Access at times or from places that do not fit that person.
- Permission changes nobody remembers making.
| What you see | What it usually is | What to do |
|---|---|---|
| 400 documents downloaded on a Friday | Someone preparing an audit… or leaving | Ask, without accusing |
| Access at 4am | Almost always a different time zone | Check who and from where |
| A permission widened for no reason | A change made in a hurry and never reverted | Review it and set it back |
Important
Finding something odd is not accusing anyone. The vast majority of what stands out has an ordinary explanation, and asking before concluding is what makes this habit sustainable in a small team.
When to look properly
When someone leaves on bad terms, when there is a dispute, or when something does not add up. That is when the log stops being hygiene and becomes the thing that answers the question.
Watch out
The log cannot be edited, and that is deliberate: a log an administrator could retouch would prove nothing.
›How long is it kept?
According to your retention policy.
›Can it be exported?
Yes, for an audit or for your adviser.
›Can non-administrators see it?
No. It is sensitive information about the people on your team.
A real case
The situation
An administrator reviews the log and finds two active accounts for people who left months ago.
What you do
- Closes them
- Checks they were not used since
What you get
Ten minutes of review close two doors that had been open for half a year.
The situation
The log is only looked at when there is a problem.
What you do
- Reviews what matters regularly
What you get
The odd thing shows before the incident.
The situation
Access appears at an unusual hour.
What you do
- Checks with the person before raising the alarm
What you get
The anomaly is explained or acted on.
The situation
Somebody downloads many documents at once.
What you do
- Checks what and why
What you get
The movement is understood.
The situation
An auditor asks for evidence of oversight.
What you do
- Shows the reviews performed, with dates
What you get
Oversight is demonstrable.
The situation
The log has too much noise to read.
What you do
- Filters by what actually matters
What you get
The review is manageable.
This article answers
- see who did what
- platform audit log
- who downloaded that document
- detect improper access