are the moodle activity logs ever wrong?

are the moodle activity logs ever wrong?

by Megan Marcotte -
Number of replies: 14

A student accessed resources in Moodle during their online Moodle lab exam (other than the lab exam). The student is swearing up and down that they did not open those resources during the lab exam. Are there instances where the activity logs are wrong? If so how could that be checked? 

Thank you!

Average of ratings: -
In reply to Megan Marcotte

Re: are the moodle activity logs ever wrong?

by C Behan -
I think it's unlikely.
It might be worth investigating the possibility that someone else was logged in as that person on a different machine, maybe a classmate? Did they walk away from a computer while still logged in and that computer could have been accessed by someone with a similar interest in those resources at that time? Did the student share their credentials with someone else?
Someone else here with greater technical knowledge of Moodle might have suggestions for further investigation.
Average of ratings: Useful (3)
In reply to C Behan

Re: are the moodle activity logs ever wrong?

by Rick Jerz -
Picture of Particularly helpful Moodlers Picture of Testers
Which logs are you referring to? I assume that you mean {Course} | Reports | logs, and then you can filter by various criteria, like by student and exam activity. Right?

If it were me, I would filter by the student of interest, and probably the day of the exam. Then I would also look at the IP address for this student, perhaps during the time of the exam. I would probe a little deeper to see if this student usually accesses Moodle from the same IP address. If it looked like same student and same IP address, I would confront the student with this information.

Realize, the if the student was using their smartphone from a "hotspot" that the IP addresses might not match. This is why I would look at IP address over a range of days for this student.

If it was another student, as C Behan suggests could have happened, I would explore Moodle's logs to see who this IP address belongs to, and probe deeper from there.

I am not an expert on this, but having Moodle's excellent logs that contain IP address, student, date and time, is what I would use. I have used this method for my own student problems and claims. The situation that I have is that my university uses Canvas, which doesn't have these kinds of logs available to the instructor. Students learn about this, and they then claim whatever they want. Then they try to do the same thing in my class, and I present the logs! ("Shucks!" is about all the student can say.)

The vast amount of Moodle's logs suggest to me that they are not wrong.

You can also try to use your server logs. I have never done this, but I sure some networking folks would say it is doable.
Average of ratings: Useful (2)
In reply to Rick Jerz

Re: are the moodle activity logs ever wrong?

by Megan Marcotte -
Thanks so much. Yes that's interesting to follow their IP for a few days. I'll look into server logs.
I did find a post from 2016 I think that exporting logs to moodle caused a time issue, but I'm looking right in Moodle. Or I saw one post about a course import making dates and times wrong but neither situation applies here so I can't find anything that suggests the logs are wrong. I'll look into the server idea.
Average of ratings: -
In reply to Megan Marcotte

Re: are the moodle activity logs ever wrong?

by Ken Task -
Picture of Particularly helpful Moodlers

Concepts: networking comes before application.  Moodle is the endpoint (application).

The ip addresses you see in moodle logs shouldn't be 10.x.x.x or 192.168.0.x or 172.16.0.0 – 172.31.255.255 as those are all private IP addresses to be used inside a private network.   They are non-routable.

What you do see (if user not using VPN or something to obscure their IP/location) is the public IP address of their gateway (home router).

There could be a group of students at a location ... let's say Student A's house ... that could use different devices ... smartphone/'fablet'/laptop/tabletop ... all connected to the 'house' private network, and all of them (Students A, B, C, D, E) would show to moodle as coming from a single IP address.

When one suspects 'funny business' quite a bit of sluething is required:

a cli query of moodle logs to see an ip

That same IP used in an operating system of the server DNS query (dig -x IP) to see what provider.   And to double check that same from your workstation.

Providers of connectivity have their own naming conventions so a dig -x on an IP will give some more info to slueth or contemplate ... or guess.    Some, on the other hand, do have 'names' that do give hints/clues.

Example (obscured):

cpe-76-190-19-175.satx.res.rr.com

Network is RoadRunner ... and segment is in San Antonio, Tx.

SA, Tx has a population over 1 Million folks ... don't know how many use Spectrum vs AT&T vs other for their connectivity at home.

Do know, however, that a single person today might own/use multiple devices ... soooooo ..... good luck with very accurate/consistent sluething!

What I have done in past ... created a static trouble shooting web page ... not in moodle ... troubles.html ... and when students reported issues in Moodle, I'd ask them to access that page ... had only an image in it ... 'Muchas Gracias'.

I could then search web server (not moodle DB) access and error logs for 'troubles' and see iP/browser info.

Back then, there exist (believe it or not) Windows Phones and they had issues (no wonder).

Try this with your own smartphone ... access your Moodle server using brower on phone and login.   Then via controls on phone change network to local lan or carrier ... which ever is a new connection to network than when you logged on to Moodle.

Then go look at server raw logs and moodle's logs.

Fun and games! smile

'SoS', Ken



Average of ratings: Useful (2)
In reply to C Behan

Re: are the moodle activity logs ever wrong?

by Megan Marcotte -
All at the same IP address and it was a timed online, exam taken presumably from their home. Thanks for the thoughts!
Average of ratings: -
In reply to Megan Marcotte

Re: are the moodle activity logs ever wrong?

by Randy Thornton -
Picture of Documentation writers
Megan,

One possible issue in cases like this is a time zone difference. If an admin is looking at the logs, the times appear in the time zone set for them in Moodle, and I have seen this lead to confusion, such as "At 3:10 you accessed this document" and the student in another time zone says, "No, at 3:10 I was taking the test...." could both be correct because "3:10" is a relative not absolute time. And the logs themselves are stored in an absolute time format: you can always find that exact time if you need to.

You can eliminate this as a possibility if the exact sequence of events in the log shows the user is accessing other things in the middle of the quiz events.
Average of ratings: Useful (2)
In reply to Randy Thornton

Re: are the moodle activity logs ever wrong?

by Randy Thornton -
Picture of Documentation writers
Also, if the IP addresses match then it was the same computer. If you allow multiple logins, then a user can have two different browsers open at the same time logged in to Moodle.

The Moodle logs do not catch this difference in sessions (unfortunately) on log in or other activities, they only note the session ids on logout, so you can't really tell from the logs which browser is doing what. However, the web server logs will be able to tell you which browser was doing what.
Average of ratings: Useful (2)
In reply to Randy Thornton

Re: are the moodle activity logs ever wrong?

by Megan Marcotte -
Hi Randy, yes the access to materials that we are concerned about is in between access events for the assessment and both are listed during the time the assessment was open. So it looks very reliable and I think safe from time zone influences. Especially if the student opens a resource on the topic of the question they are working on and then goes back to that question.
It's such a pity that this happened.
Average of ratings: -
In reply to Megan Marcotte

Re: are the moodle activity logs ever wrong?

by AL Rachels -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Hi Megan,
From the standpoint of haven written the logging code for multiple plugins that I maintain, I would suggest that the logs are right and the student is NOT being truthful.
Average of ratings: Useful (5)
In reply to AL Rachels

Re: are the moodle activity logs ever wrong?

by Rick Jerz -
Picture of Particularly helpful Moodlers Picture of Testers
Megan, I agree with Al, based upon what you have said. Let's review.

You tell the student to take an exam, but they cannot go to Resource A. The logs show the student's name, and this student is taking the exam and accessing Resource A, all showing the same name and same IP address. For the logs to show the same name and IP address, I would say this is only possible if someone else is logged in as the student at the same IP address, which still probably violates your policy.

So, if it was me, I would show the student Moodle's logs and say "The logs show that you cheated. Moodle is used across the world and by many schools... Moodle, and the logs are quite accurate." If you had to, you could repeat taking the exam and accessing Resource A to show your administration what happens.
Average of ratings: Useful (1)
In reply to Rick Jerz

Re: are the moodle activity logs ever wrong?

by Megan Marcotte -
Yes good idea. The system has been trialed and it does indeed seem accurate. Was just curious if there were known occasional issues. Sounds like it's a no, as I expected! Thank you
Average of ratings: -
In reply to Megan Marcotte

Re: are the moodle activity logs ever wrong?

by Ken Task -
Picture of Particularly helpful Moodlers

"lab exam" ... does that mean students were taking this exam from a computer 'lab'?  OR students were taking a 'lab exam' from different remote locations?

Does this event happen often with this particular student?

Are there any 'rules' when it comes to 'monitoring' students?

What if you asked this student to participate in a 'pilot test' of something which happened to include the taking of 'lab exams' ... student would have to agree to use software like TeamViewer or other and inform you when they were going to be online and invite you to 'watch' their screen.

Anyhoo, much to ponder about 'cheating' ... if that is what this is about.

'SoS', Ken

Average of ratings: Useful (2)
In reply to Ken Task

Re: are the moodle activity logs ever wrong?

by Rick Jerz -
Picture of Particularly helpful Moodlers Picture of Testers
Good questions, Ken. This reminds me of a cheating situation that once occurred to me. In my case, I said that students must take their exams by themselves, with no one around them. I ended up with a situation where three students began their exam at approximately the same time, finished at the same time, and it turned out that they were all at the same IP address. I called this "cheating" and eventually, the students agreed. However, they could have claimed that the "timing" was by chance and that they took their exams from different computer labs on campus, meaning that they were not in the same lab. I asked my IT department if they could determine the computer that each student used, and I was told (whether true or not) that they could not. But it was possible that the students could have had the same IP address in Moodle.

This situation encouraged me to use more randomized question exams.

But this is a different situation than Megan's, where she didn't want the student to open other resources. I believe that what she is saying is that the Moodle log showed the student clicking on the quiz and during the same time, clicking on other resources.

Don't misunderstand my comments. I am not questioning anything that you have said, and I like your train of thought. Yes, I am just pondering about "cheating," which may help Megan.

So let me see. Megan says to students "You are not allowed to open any resource pages while taking your exam." So the student takes her literally and tells a friend, "Login as me, go to the resources web pages, and "tell" me what you see." Then the student claims, "I didn't open any web pages!"  🙄
Average of ratings: Useful (2)
In reply to Rick Jerz

Re: are the moodle activity logs ever wrong?

by Megan Marcotte -
I do personally try to cover it all and say you are only allowed the Moodle quiz page and to private message me on the internet. You cannot help or be helped by anyone (friend, stranger, enemy...). You cannot document the quiz etc. And, yes the students were writing randomized assessments remotely because of Covid and this is a potential academic integrity concern.
Re teamviewer, we have quite strict rules about what we can ask the students to use (for their protection) and so I do have to counteract the temptation to cheat where I can, catch it when I can, and have to trust them some. I can't supervise them like if we were together. I just wanted to do my due diligence in case the student was encountering a glitch in the logs. From what I've seen online and here it doesn't sound like a known issue.
Thank you all very much for your help and this discussion!
Average of ratings: -