Review the access log
Investigate authentication and account-security events, keeping them distinct from the queue and supervision commands recorded in the operational log.
Open the event history
Go to Administration → Access log. Besides login outcomes, its event filter includes user and profile changes, password and 2FA operations, security-policy changes and configuration backup or restore outcomes. Begin with the time, account and event type relevant to the incident.
Narrow the investigation
Use the filters available on the page and read the event fields together. A sequence of failed attempts followed by a successful login needs more context than one isolated row. Keep the server’s time reference in mind when comparing another system’s logs.
Identify the event
Match the account, timestamp, result and network address shown. Preserve only the evidence needed for the investigation and share it with authorized staff.
Review the surrounding attempts
Check adjacent entries before changing account or network restrictions. An address can represent a shared connection or a correctly configured proxy.
Follow the event and its actor
Set the date range, choose an event type and use the search field to narrow the entries. Read the affected username and actor together: an administrator resetting another account’s password is a different event from that account signing in. Use previous and next pages to inspect the surrounding sequence.
| Event family | Useful evidence |
|---|---|
| Login and logout | Time, username, outcome or reason, IP address and browser; compare failures and temporary locks with later attempts. |
| Accounts, profiles and 2FA | Who changed the account, profile, password or two-factor setup, and which account was affected. |
| Security and session policy | Policy changes or denied addresses provide context when access changes without a password change. |
| Configuration backup and restore | Distinguish download, preview, restore and recovery events. Read their outcome and archive information instead of treating every backup event as a completed restore. |
Verify a correction
After correcting credentials or an access rule, perform one controlled login and check its result in the log. If the recorded address belongs to a proxy, verify the trusted-proxy configuration before interpreting it as the user’s origin. Do not trust arbitrary forwarded headers.
What this log establishes
Read actor and affected account separately when one administrator changes another user. For backup events, examine the recorded outcome and archive information. This is a record of supported application events, not every subsequent activity; coordinate investigations and evidence retention with the responsible security or privacy staff.
Use the controls, understand what changes
Read Actor and affected Username as separate columns. A password reset performed by an administrator is not a login by the affected user. Narrow the event and date filters, then read the surrounding entries before changing a security rule.
Complete product screenshots
Illustrative data. Open the screenshot to enlarge it and match the controls to the instructions in this chapter.
Open complete screenshot