How can we help?

Search for answers or browse our knowledge base.

Table of Contents

What data and metadata are available in activity log events?

Updated

The WordPress activity log is made up of events. Each individual event includes data and metadata related to that event, providing you with context and information about each event logged. In this article, we explain the different types of data and metadata that you can find in activity log events.

What is data?

Data is the information that is part of the event. This includes the event ID, user, IP, etc. The most important data is displayed in the Activity Log Viewer screen by default.

What is metadata?

Think of metadata as data about the data, in this case, data about the data collected in the event. As metadata is event-dependent, not all events will have the same metadata. Instead, metadata for a particular event will be restricted to the data collected for that event.

Why is metadata used?

Metadata provides additional information about the event. It has a variety of uses, including search, the ability to capture additional information, and other uses. In WP Activity Log, metadata is also used to run hooks, giving you the ability to extend the functionality of the plugin to meet custom operational criteria.

What data and metadata are available with WP Activity Log?

WP Activity Log events include a healthy amount of data and metadata. You can find an updated list below:

Event ID

wp activity log events

The event ID consists of 4 digits. Every ID represents a specific change or user action on the website. For example, whenever a user logs in, the plugin keeps a record of the login in an event with ID 1000. Event IDs are very important. Through them, you can easily:

  • Search for a specific change in the activity log
  • Configure SMS and email notifications for when specific changes happen
  • Generate specific user or website changes reports

Further reading:

Severity level

wp activity log events severity

The severity level of an event indicates the impact the change or action can have on the website’s security, performance, and functionality. For example, an event in the activity log about a new plugin install has a critical severity level because you need to know about such a change on your WordPress. An event about a user logging on to the website has a low severity level because you do not need to know every time a user logs in to your website.

Further reading:

Date & time

wp activity log events date

The plugin keeps the date and timestamp of every change it keeps a log of in the activity logs. The format of both the date and time stamp, and also the timezone, is the same as that configured on the WordPress website.

Further reading:

User and role

wp activity log users

This metadata indicates the user who made the change and the user’s role. In case the change was made by an automated system process, such as purging old activity log data, the plugin indicates ‘System’ as the user.

Further reading:

IP Address

WordPress activity log IP address

This is the IP address from where the action or change originated. Note that this is the user’s public IP address. So if the user is using a VPN or is on a network, you will see the public IP address of the network. If the change is a system change, for example, when WordPress automatically deletes auto-saved draft posts, the reported IP address is that of the website itself.

All IP addresses reported in the WordPress activity logs are linked to WhatIsMyIPAddress.com, so you can easily see where the IP address originates from and read other vital information about it.

Further reading:

Object

WP Activity Log event viewer object

This is the object the activity log event is about. For example, when a user changes the password, the object of the event is User because the event is about a change in a WordPress user profile. Event objects are handy because you quickly get an idea of what the event is about. Objects can also be used as filters.

Further reading:

Event type

wp activity log event type

The event type describes the type of change the event is reporting. For example, when a plugin is activated, the event type reads Activated. When an editor publishes a post or a page or a store manager publishes a new product in WooCommerce, the event type reads Published.

Like Objects, event types are handy because they give you an idea of the kind of action the event is reporting. It can also be used as a filter when you need to filter the activity log view to find a specific event in the activity log.

Further reading:

Message

wp activity log event message

In this section, you will find the remaining metadata and details about the object and change reported in the event. For example, if the event is about a blog post, here you’ll find the blog post title, the post ID, status, URL, etc.

Additional data

Aside from the data that is visible in the log viewer, logs contain additional information about the event. This information can be viewed through the Event Data Inspector.

Event Data Inspector

The activity log Event Data Inspector is an additional WordPress activity log tool that can be used to view:

  • Additional technical details that are not shown in the alerts by default, such as the UserAgent string, Post ID, Post Date, etc.
  • The value of an object that is too long to be displayed in the activity log viewer

The Event Data Inspector can be accessed by clicking on the ellipsis button (…) at the far right edge of the log entry.

In the example below, we can see that a user changed the meta description of a published post. Since the values of the old and new meta descriptions are too long to be displayed in the log viewer, the alert reports the change without displaying the old and new values.

WP Activity Log meta description change

To see the values, you will need to open the data inspector. The screenshot below shows the Event Data Inspector, which shows the changes in the META description of a blog post.

WP Activity Log Event Data Inspector

Notice that you can see both the old and new values and all the details the plugin records about the post, such as the Post ID, status, type, URL, and revision link. The plugin also stores the Session ID of the user who did the change.

Extracting activity log data using hooks

Data presented in the Event Data Inspector can be extracted programmatically through WP Activity Log hooks. Below is a list of all the variable names, each representing specific data from the activity log. For example, the %Message% variable represents the actual message you see in each event in the activity log viewer.

%Message%

%PromoLink%

%CommentLink%

%MetaLink%

%RevisionLink%

%EditorLinkPost%

%EditorLinkOrder%

%CategoryLink%

%cat_link%

%ProductCatLink%

%TagLink%

%EditorLinkForum%

%EditorLinkTopic%

%MetaValue%

%MetaValueOld%

%MetaValueNew%

%ClientIP%

%LinkFile%

%URL%

%LogFileLink%

%Attempts%

%LogFileText%

%PostStatus%

%ProductStatus%

%multisite_text%

%ReportText%

%ChangeText%

%ScanError%

%TableNames%

%FileSettings%

%ContactSupport%

%LineBreak%