I routinely inspect the quiz logs files due to the manner in which we administer the graded course work.
In terms of a timeline (hr:min:sec level) I used to see "quiz view" then "quiz attempt" and then "quiz continue attempt" as a student entered the quiz. Seemed quite logical. Now I sometimes see "quiz continue attempt" prior to "quiz attempt". Can any one offer scenarios as to how this might arise ?
Moodle logs are only stored with the time to the nearest second. If is possible for two actions to happen in the same section, particularly when one page redirects to another, like startattempt.php redirecting to attempt.php. In that case, the log entries may be displayed in either order.
OK. So if the timeline is several seconds apart (i.e. distinct hr:min:sec), I would assume that this would imply that the student was definitely accessing those specific pages in that timeline order ?
Note that the quizzes I am monitoring are single attempt. In addition the review options are such that students only get to review marks and overall feedback immediately and later while the quiz is open but full access after the quiz is closed.
Since my previous post, I notice that I also see "quiz continue attempt" after "quiz close attempt". I suspect that this might be a sign of multiple browser windows, but are there other scenarios ? I assume a student couldn't change answers in one window after closing a quiz in a second window ?
Thanks!
Another common source of confusion is two load-balanced servers with badly synchronised clocks.
It turns out that that was exactly the issue. We recently switched to a dual server configuration and have also endured a couple of power outages. Servers were 147 seconds out wrt each other. A better set up has now been implemented. THANKS for the great trouble shoot!