Disappearing Users

Disappearing Users

by Jayden Tyronian -
Number of replies: 11

Hi all

Today we came across an active user that had disappeared.  On further look, its as if they were deleted (ie no longer appears in moodle at all as a user.

I've taken a look in the sql database to see if I could identify why, but in the user table the student doesn't appear at all, which is odd since even if they are deleted in moodle front end, they still have a line int he user table with the appropriate field marked as 1 in the deleted field.  I've search on their first and last name plus a number of known things associated with their profile.  Nothing.

The student exists in the front end only on grade reports as a taking online exams etc as normal, but still no user line for the student when there should be.

So I now have more than one issue/query:

1) How did the user get deleted at all (all the Admins or those with the ability to delete a user have all said they haven't deleted the user - so I'm at a loss how they got deleted at all

2) Even if they did get deleted, why then is there no listing for them at all in the user table, yet is clearlyappearing at the very least in the grade reports like a deleted user?

This is a big issue.  I recall there had been the odd report of random students also disappearing, but they were in relation to new signups and I put that down to the fact they never did the confirmation step and so they were auto deleted.  This is the first time that I know and recall whereby an active user of moodle has mysteriously disappered.

Can anyone assist/help?

Jayden

Average of ratings: -
In reply to Jayden Tyronian

Re: Disappearing Users

by Ken Task -
Picture of Particularly helpful Moodlers

Run this query on your mdl_user table:

select * from `mdl_user` where `username` like "%.1%";

You'll see that the users are still there but their information has been obscured.

deleted is set to 1 and their email address has an epoch time stamp added to the end.

LIke user@gmail.com.1637248930 the time stamp is when it occured and probably matches the timemodified column.

The email column has what appears to be hash of some sort ... not their email address.

Edit that row and student should be able to login again.

And, no, I have no idea how that happened with your system.

Good luck!

'SoS', Ken

Average of ratings: -
In reply to Ken Task

Re: Disappearing Users

by Jayden Tyronian -
Done - User does not appear on that list NOR the 'active' list either.

Jayden
Average of ratings: -
In reply to Jayden Tyronian

Re: Disappearing Users

by Visvanath Ratnaweera -
Picture of Particularly helpful Moodlers Picture of Translators
Has the admin restored a site backup or a VM snapshot?
Average of ratings: -
In reply to Visvanath Ratnaweera

Re: Disappearing Users

by Jayden Tyronian -
No they haven't. I'm also attempting to find out when the user disappeared. I know for a fact they were onthe site and used the site on 31 Dec 2023 for absolute certain at this stage.

Jayden
Average of ratings: -
In reply to Jayden Tyronian

Re: Disappearing Users

by Dan Marsden -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers Picture of Plugins guardians Picture of Testers Picture of Translators

How do your users authenticate to the site? - are you using an external IDP or an integration that syncs users across like oidc or an old oauth plugin or external database or 3rd party plugin that syncs users?

Also - what database type do you use? - have you run any health checks on the db to ensure it doesn't have any corrupt indexes etc?

Average of ratings: -
In reply to Dan Marsden

Re: Disappearing Users

by Jayden Tyronian -
Hi Dan

Users log into moodle directly no other intergration or SSO etc. We are using Moodle 3.11+ running it on a Linux Redhat system that is on its own server (not shared). We are using Mariadb for the sql database.

I have not run a health check but I shall do so.

Jayden
Average of ratings: -
In reply to Jayden Tyronian

Re: Disappearing Users

by Ken Task -
Picture of Particularly helpful Moodlers

Did you run my suggested query?

Health check - also run check in admin/cli/

php check_database_schema.php

Have you run any course resets?

'SoS', Ken

Average of ratings: -
In reply to Ken Task

Re: Disappearing Users

by Jayden Tyronian -
i did but for some reason it never came up. I have used the quiz entry to identify the users uniqueu user id number and I manually went through and located that record line and found the user. I have now removed the deleted tag etc and the user is back in the moodle front end.

The health checks all seemed to indicate all was/is okay. So I still don't know or understand why the user was deleted to begin with on the basis that the admins have all said they didn't do it. Is there another way to identify why, who, how the user was deleted?

Jayden
Average of ratings: -
In reply to Jayden Tyronian

Re: Disappearing Users

by Visvanath Ratnaweera -
Picture of Particularly helpful Moodlers Picture of Translators
> i did but for some reason it never came up.

Do you mean this SQL?
>> select * from `mdl_user` where `username` like "%.1%";

Why those back-ticks (`)?

> I have now removed the deleted tag etc and the user is back in the moodle front end.

Do you mean the "deleted" column in the "user" table? Then that user is properly deleted from the front-end. Go through the logs of the user 'admin' and all users who are Site administrators. Unless you found the cause, this is bound to happen again!

Average of ratings: -
In reply to Ken Task

Re: Disappearing Users

by Jayden Tyronian -
I'm now attempting to identify why, how, and when this user was deleted.

I'm venturing into a realm I'm not well versed in having not had to really do it before. Any help to assist me in trying to answer those questions would be helpful. I've been asked to find out as the user deleted in question is making noise about it accusing a specific person of doing it (not that that person has permission to delete users).

I found the mdl_logstore_standard_log for the user that got deleted but I see no entry for deletion.

Jayden
Average of ratings: -
In reply to Jayden Tyronian

Re: Disappearing Users

by Visvanath Ratnaweera -
Picture of Particularly helpful Moodlers Picture of Translators
Aha! Yes, forensics is a deep topic, whether Moodle or any other topic in IT.
wink

Remember that there are also web server logs. Other than that, if this is for a legal case, you might have to get the service of an expert, like a Moodle Partner. There are also freelancers in the forums. They might reply if you advertise in https://moodle.org/jobs.

Average of ratings: -