Who changed that? The user actions log
Something on the site is different and nobody admits to it. Joomla has kept a record the whole time, and most people never look.
Users, User Actions Log lists what happened in the administrator area: who did it, what they did it to, and when.
What ends up in it
- Logins and logouts, including the failed ones.
- Articles and other content created, edited, published or trashed.
- Users added, changed or given different groups.
- Configuration changes.
- Extensions installed, updated or removed.
Which of those get logged depends on the actionlog plugins that are enabled, so the list is not fixed. Check the plugin manager rather than assuming everything is covered.
Keeping it useful
In the component options you can set how long entries are kept. Left unbounded the table grows forever on a busy site, and a log nobody can search is not much of a log.
Pair that with the Delete Action Logs task in the scheduler and the trimming happens on its own.
What it is good for
Two things, mostly. Answering "when did this change and who did it" without anyone having to remember. And noticing logins at hours when nobody should be working, which is the cheapest intrusion detection you will ever set up.
What it is not
It records the administrator area. Front-end activity, direct database changes and anything done over FTP leave no trace here. If someone got in through a compromised extension rather than the login form, the log will be quiet.
It is also written by the site it is protecting. Anyone with Super User rights can clear it. For a site where that matters, ship the log somewhere else as well.
Doctor Joomla is written by Cloudfaction, a Dutch agency building and maintaining Joomla sites since 1999. Mail info@cloudfaction.nl if you want someone to look at yours.