When are Event log records created and where is the documentation to show how to interpret them

[Greg-at-anypoint]

I have been given a log file to comment on but do not know what it is and how, when and why the entries in it are created. Well I assume it is an EVENT LOG and the entires are created when an IP address changes, but is this because the member has remained logged on? If they had logged off would the log record still be written?

Here are the first 2 lines is there someone who can assist ?

Where / how do I find it when I log in to my account and is it only for business accounts? 

I have modified any personal details ....

COLUMN HEADERS

Member Member email Event type Category Access Method IP Address Country City Involve non team members Participants Context Other info

COLUMN DATA

The Member info@themembers-email.com Changed IP address associated with active desktop session Devices Desktop Devices Desktop 123.12.12.123 Australia MyCity No None ""{".tag": "team_member", "account_id": "dbid:AADHdCwPDk2H16hkRPDA2Bm5c1Vhpr7hXko", "display_name": "The Member", "email": "info@themembers-email.com", "team_member_id": "dbmid:AACX_OLjX-6QgYLCH6_ARL9TvlHrbivbnTY"}"" ""{".tag": "device_change_ip_desktop_details", "device_session_info": {".tag": "desktop_device_session", "ip_address": "99.999.999.999", "created": "2021-01-07T21:00:37Z", "updated": "2022-03-10T07:31:19Z", "session_info": {"session_id": "dbdsid:AAB3yUZdowpf086xdE90_LP2zqD_SFQbbWs"}, "host_name": "hostname.local", "client_type": {".tag": "mac"}, "client_version": "143.4.4161", "platform": "Mac OS X 11.2.3", "is_delete_on_unlink_supported": true}}""

[Rich]

---

@Greg-at-anypoint wrote:

Where / how do I find it when I log in to my account and is it only for business accounts?

---

That appears to be an activity log, which is available to the team admin on Business accounts.

• https://help.dropbox.com/teams-admins/admin/view-activity

[Greg-at-anypoint]

Thank you Rich,

Following the link, the documentation lists events  that are available in Team activity reports, however the event listed in the log sample is "Changed IP address associated with active desktop session", I would like to know if this happens because a person is ALREADY logged in and does not log out and then moves to a different location with a new IP Address. Can you point me at some information on this event?

Doco says ...

Admins have the following events available in their team activity reports:

• Apps
• Comments
• Devices
• Domains
• File operations (Advanced and Enterprise only)
• File requests
• Groups
• Logins
• Members
• Paper
• Passwords
• Reports
• Sharing
• SSO
• Team folders
• Team policies
• Team profile
• Two factor authentication

[Nancy]

Hey @Greg-at-anypoint, hope you’re doing great!

What you mention in your message sounds correct; if a user changes location while they’re logged in to their Dropbox account, the IP address of their device should also be updated and it should be reflected on your activity report. 

If you need something else though, give me a nudge.

[Greg-at-anypoint]

Thank you Nancy,

There are a couple of other questions about the log records that don't add up. Below is a link to the full file, an excel spreadsheet with the identification details removed. I have highlighted some of the data.

[Removed as per Community Guidelines]

1. It appears the IP address did not change, but a new log record was written on consecutive days at different times - is there a reason for this given that the Event Type was the same "Changed IP address associated with active desktop session"

2. Are only the past year kept (or displayed by default) as it says the device was first created on 7 January 2021. but the first log record is 24 November 2021.

No problems if beyond scope of community support - just couldn't find any doco on this.

All the best

Greg Searle

[Jay]

Hi @Greg-at-anypoint, if you have any specific queries about log entries, we'd recommend contacting the support team directly for security and privacy purposes.