Omni Logger
How Omni Logger records activity on your site, how to read and filter the log, and exactly which events it records.
Written for Omni Logger 0.8.5
Omni Logger is a Side Kick module that keeps an activity log for your site. Each entry says who did what, to what, and when, with the before and after values where there are some. Omni Logger needs Darwin Side Kick installed and active. Logging starts as soon as the module is active. You can find out more on the Omni Logger product page.
Finding the log
Open Darwin Side Kick and choose Omni Logger in the Modules part of the sidebar. Like the rest of Side Kick, it is only available to users who can manage site options, which normally means Administrators.
The Refresh button at the top reloads the figures, counts and entries.
The overview figures
| Figure | What it counts |
|---|---|
| Today | Entries since midnight, in your site's time zone. |
| Last 7 days | Entries in the past seven days. |
| Worth a look | High and critical entries in the past seven days. |
| Most active this week | The signed-in person with the most entries in the past seven days. |
Categories, search and filters
The Categories panel on the left lists All activity and each category that is switched on, with a count of entries. Your browser remembers the category you last chose.
- Search entries finds words in an entry's name or details, such as a page title, a username or an old value. It runs a moment after you stop typing.
- The severity filter offers Everything, Medium and up or High only. High only includes critical entries.
- The person filter starts at Anyone. Pick a person from the list to see only their entries. System or nobody signed in covers entries no signed-in user made.
Filters work together. Each change starts the list again from the newest entry.
Reading the log
Entries are listed newest first and grouped by day, headed Today, Yesterday or the day of the week, with the full date and the number of entries. Times are shown in your own browser's time zone. Hover over a time to see the full date.
Each entry shows:
- A round mark: the person's initials, a gear when the site acted on its own (for example a scheduled post going live or an automatic update), or a question mark when nobody was signed in (for example a failed login).
- A sentence describing what happened, with names in bold. Bold names that link to something open it in a new tab: the edit screen of a post, page, user or term, or a web address. Links are worked out when you view the log, so something that has since been deleted no longer links.
- The category, who did it, the severity and the time.
Long values are cut short in the list. The list loads 50 entries at a time. Click Show older entries to add the next 50.
Entry details
Click an entry to open its details. These show What happened, When, By, Severity, Event (a four-digit event code and name) and, where there is one, the Object it happened to. Below that is every detail stored with the entry, such as old and new titles, version numbers or the lines added to a file, shown in full.
Severity levels
| Level | Meaning |
|---|---|
| low | Informational. Nothing was removed. |
| medium | A change that may affect content or users. |
| high | A significant change with a notable impact on the site. |
| critical | The site's security or integrity may be at risk. |
Some events are rated higher when an Administrator account is involved, as noted below.
Choosing what is logged
- Open Darwin Side Kick and go to Settings.
- Choose the Omni Logger page.
- Under What is logged, switch categories on or off: Logins, Comments, Site integrity, Media, Pages, Plugins, Posts, Categories and tags, Themes and Users.
- Click Save changes.
Every category is on by default. Switching one off stops new entries and keeps the ones already logged. While a category is off, its existing entries are also left out of the log screen and the figures. Switch it back on to see them again.
Events reference
Logins
| Event | Severity | Notes |
|---|---|---|
| User logged in | low | Records the user's roles. |
| User logged out | low | |
| Failed login attempt | medium | A real username with the wrong password. |
| Failed login, unknown user | medium | Records the username that was typed. |
| Password reset | medium | A user set a new password using a reset link. |
Posts and pages
Posts and Pages are switched separately but record the same events, named "Post …" or "Page …". Only standard posts and pages are logged.
| Event | Severity | Notes |
|---|---|---|
| created | low | Records the status it was created in. |
| published | low | Says "on schedule" when a scheduled item goes live by itself. |
| set as draft, scheduled, submitted for review | low | |
| set as private | medium | |
| title changed, slug changed | low | Old and new values. |
| content modified, excerpt modified | medium | |
| author changed | medium | Old and new author. |
| visibility changed | medium | Between public, password protected and private. |
| parent changed, template changed | low | Old and new values. |
| date changed | low | Only for published, private or scheduled items. |
| featured image changed | low | Includes removing it. |
| terms modified | low | Categories, tags or other terms added or removed. |
| moved to trash, restored from trash | medium | |
| permanently deleted | high | |
| ACF fields updated | low | With Advanced Custom Fields active, when a field value actually changes. |
Media
| Event | Severity | Notes |
|---|---|---|
| File uploaded | low | |
| File title changed, alt text changed, caption changed | low | Old and new values. |
| File description changed | low | |
| File deleted | medium | Permanent deletion. |
Comments
| Event | Severity | Notes |
|---|---|---|
| Comment posted (pending) | low | Only comments held for approval. |
| Comment approved | low | |
| Comment unapproved, marked as spam | medium | |
| Comment moved to trash, restored from trash | low | |
| Comment edited | low | Only when the text or author name changed. |
| Comment deleted | medium | Permanent deletion. |
Categories and tags
Covers terms in every public taxonomy (a taxonomy is a way of grouping content, such as categories or tags). Adding or removing terms on a post is logged under Posts or Pages.
| Event | Severity | Notes |
|---|---|---|
| Term created | low | |
| Term updated | low | Logged when a term is renamed. |
| Term deleted, Term merged | medium | |
| Term ACF fields updated | low | With Advanced Custom Fields active. |
Users
| Event | Severity | Notes |
|---|---|---|
| User created | medium | Records the role. |
| User deleted | high | |
| User profile updated | low (medium for Administrators) | Name, nickname, display name, website or biography. |
| User role changed | medium (high if Administrator is the old or new role) | Old and new role. |
| User capabilities changed | medium (high for Administrators) | Permissions changed without a role change. |
| User password changed | medium (high for Administrators) | The user changed their own password. |
| User password changed by admin | medium (high for Administrators) | Someone else changed it. |
| User email changed | medium (high for Administrators) | Old and new address. |
| User ACF field changed | low (medium for Administrators) | With Advanced Custom Fields active. |
| Application password created, deleted | medium | Records the application password's name. |
Plugins
| Event | Severity | Notes |
|---|---|---|
| Plugin activated, deactivated | medium | |
| Plugin installed | medium | Says whether it was manual or automatic. |
| Plugin updated | medium | Old and new version, manual or automatic. |
| Plugin deleted | high | |
| Plugin file edited | high | A file saved in the WordPress plugin file editor. |
| Plugin auto-updates enabled, disabled | medium | |
| Plugin update failed | high | Automatic background updates only. |
Themes
| Event | Severity | Notes |
|---|---|---|
| Theme activated | high | Records the theme it replaced. |
| Theme installed, updated | medium | |
| Theme deleted | high | |
| Theme file edited | high | A file saved in the WordPress theme file editor. |
Site integrity
| Event | Severity | Notes |
|---|---|---|
| Permalink structure changed | high | Old and new structure. |
| Rewrite rules changed | medium | Only when the rules really differ. Counts rules added, removed and redirected. |
| .htaccess updated by WordPress | medium | Lines added and removed. |
| .htaccess changed outside WordPress | high (critical if the file was removed) | For example over FTP, SSH or a hosting control panel. |
The .htaccess file (a server settings file many hosts use) is checked each time an admin page loads, so an outside change is caught at the next admin page load. The By name on that entry is whoever loaded that page, not necessarily the person who changed the file. The first check only records a starting point. If the file is larger than 64 KB, the change is still logged but the changed lines cannot be listed.
What is not logged
- WordPress core updates.
- Changes on WordPress's settings screens, apart from the permalink structure.
- WooCommerce orders and products, and any other content type besides posts, pages and media.
- IP addresses. Omni Logger does not record them at all.
- Plugin and theme files changed outside WordPress. Only the .htaccess file is watched.
- A plugin update that fails while you are updating by hand.
Where the log is kept
- Entries are stored in a database table of the module's own, separate from your posts and settings.
- Times are stored in UTC (Coordinated Universal Time) and converted to your browser's time zone on screen.
- There is no export.
- There is no automatic clean-up. Entries are kept until someone removes them from the database.
- There are no email or other alerts. You need to open the log to see what has happened.
- Version 0.8.5 has no uninstall routine, so deleting the module leaves the log table in the database.