Activity log mirroring technical documentation & overview

Search Knowledge Base by Keyword

You are here:

With the WP Activity Log plugin you can mirror a copy of your website’s activity log to another service or services, and also to a log file. This article gives a technical overview of how the mirroring of the activity log works, the format of the activity log when it is mirrored, and all the other technical features in the plugin related to the mirroring of the logs.

How does the mirroring of the activity log work?

The WP Activity Log plugin mirrors the activity log to the configured services in real-time. It uses a third party library called Action Scheduler to mirror the logs. It uses a fire and forget system when sending the logs to the third party library. This means that the plugin sends the activity log events to the third party library and does not wait for a response. We use this approach so the performance of the plugin and website are not affected by the speed of the connection with the third party services, or if the third party services are unavailable.

We chose to use the Action Scheduler library in the plugin because it is a proven and reliable job queue library. It is used by the likes of WooCommerce and Automattic to process millions of jobs, emails and many other objects per day.

The format of the mirrored activity log events

The format of each activity log event mirrored to a third party service is as follows:

[yyyy-mm-ddThh:mm:ss.nano_seconds+timezone] [identifier].[severity]:[message]{event_metadata_json}

Below is a breakdown and explanation of what each fields in the event is. Further down you can also find a number of examples:

[yyyy-mm-ddThh:mm:ss.nano_seconds+offset]: this is the date and time of when the plugin generated the event. In this section there is the date, the time (marked with a T), and the offset in hours from the UTC timezone (marked with a + sign).

[identifier]: when configuring a mirroring connection, in the wizard you have to specify an identifier. This could be the name of the site or a friendly name that you recognize. That identifier you specified will be added here, so you can recognize which website the logs are coming from. This is useful for when you send all your logs to a central logging system (such as AWS CloudWatch or Loggly) and you have multiple sites writing to the same system.

[severity]: this is the severity level of the event.

[message]: this is the message of the activity log event. For more information refer to the activity log events overview.

{event_metadata_json}: in this section you will find all other event metadata, including the event ID, username and role of the user who did the change, the user ID, the user IP address, the session ID and more.

Examples of mirrored activity log messages

Activity log in a log file

Mirrored activity log in a log file

Activity log in AWS CloudWatch

WordPress activity log in your AWS CloudWatch

Activity log in Loggly

WordPress activity log in in your Loggly subdomain

Activity log in Slack

WordPress activity log in your Slack channel

Creating and managing mirroring connections in WP Activity Log

You can create and manage mirroring connections in the WP Activity Log plugin by navigating to the Integrations entry in the plugin menu. To mirror the activity log to a third party service you just need to first create the connection and then configure the mirroring, as explained in each of the service’s guides featured below.

Managing the mirroring connections in WP Activity Log

You can have as many mirroring connections as you’d like. This means that you can mirror the logs of a WordPress website to several different services and log files. To configure the settings of each mirroring connection navigate to the Mirroring tab and click the Configure button next to the mirroring connection in question.

To which third party services can you export the WordPress activity log?

The WP Activity Log plugin can mirror the activity log of your WordPress website to the following: