Thanks much Nick and all others who replied! This community has a lot of knowledgeable and willing helpers.
I have the information I need.
Thanks,
Brent
From: LISTSERV Site Administrators' Forum <[log in to unmask]> On Behalf Of ? Nick Abiola-Bisiolu
Sent: Friday, October 19, 2018 10:36 AM
To: [log in to unmask]
Subject: Re: Finding out WHO Deleted Subscribers
Your log entries show that [log in to unmask]<mailto:[log in to unmask]> logged in to Listserv website and was assigned the validation code of 4B5F2589771FE4A408 which was logged to have executed the removal of the user [log in to unmask]<mailto:[log in to unmask]>.
Regards,
Nick
On Fri, Oct 19, 2018 at 10:24 AM Brent Hetland <[log in to unmask]<mailto:[log in to unmask]>> wrote:
Can someone please confirm my interpretation of the log entries below?
1. User [log in to unmask]<mailto:[log in to unmask]> logged into ListServ from IP Address 192.168.1.86.
2. That user was given a validation code of 4B5F2589771FE4A408.
3. User [log in to unmask]<mailto:[log in to unmask]> was removed from a List.
4. That user was removed by 4B5F2589771FE4A408 AUTHINFO(192.168.1.86), who is the user who logged in in Step 1 above.
----------------------- ListServ Log Entries showing a Login and a User Deleted from a List ----------------------------------
10 Oct 2018 11:32:55 From [ANONYMOUS]: X-LOGIN [log in to unmask]<mailto:[log in to unmask]> 192.168.1.86 PW=[redacted]
10 Oct 2018 11:32:55 To [ANONYMOUS]: ***OK*** 4B5F2589771FE4A408
….. skipped lines ……..
10 Oct 2018 11:33:20 To [ANONYMOUS]: [log in to unmask]<mailto:[log in to unmask]> has been removed from the BlahBlah list. No notification has (...)
10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408 AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) GETCFG: (...)
10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408 AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) WM: LIST (...)
10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408 AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) OWNER(IS (...)
10 Oct 2018 11:33:32 To [ANONYMOUS]: ***OK*** 0 0 0
….. 125 more users are deleted over the course of the next 21 minutes ……
Thanks,
Brent
From: LISTSERV Site Administrators' Forum <[log in to unmask]<mailto:[log in to unmask]>> On Behalf Of Brent Hetland
Sent: Friday, October 19, 2018 9:23 AM
To: [log in to unmask]<mailto:[log in to unmask]>
Subject: Re: Finding out WHO Deleted Subscribers
Thanks KP,
I am the ListServ admin (we are a very small business and we only do what we need to, with ListServ).
Regarding the owners… There are only 4 owners of this list, but I believe this was done maliciously so I’m first trying to find out what I can, before speaking to them.
I’ll look in the listserv logs…
Thanks,
Brent
From: LISTSERV Site Administrators' Forum <[log in to unmask]<mailto:[log in to unmask]>> On Behalf Of k p
Sent: Friday, October 19, 2018 9:19 AM
To: [log in to unmask]<mailto:[log in to unmask]>
Subject: Re: Finding out WHO Deleted Subscribers
The identity of the actor for the event is find-able in the LISTSERV log, your site administrator could take a look.
But the system is designed on the premise that events occur only with proper permission and authentication, and generally isn't subjected to a lot of audit requirements.
Is the number of owners, for the list in question, so large that you can't just ask each of them whether they did something to the list last week?
On 10/19/2018 7:32 AM, Brent Hetland wrote:
Hi All,
�
I have a list setup to NOT Auto-Delete Subscribers.
�
Yet in a single day (10/10/2018), 126 Subscribers were deleted from the list.
�
Q. How can I see WHO did this?
�
The .changelog file and the CHANGELOG database table simply show me the deleted subscribers and the time they were deleted, but not who deleted them.
I can�t believe a product that has been around so long, wouldn�t log the user who performed the action�
�
Thanks,
Brent
________________________________
To unsubscribe from the LSTSRV-L list, click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
________________________________
To unsubscribe from the LSTSRV-L list, click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
________________________________
To unsubscribe from the LSTSRV-L list, click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
________________________________
To unsubscribe from the LSTSRV-L list, click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
############################
To unsubscribe from the LSTSRV-L list:
write to: mailto:[log in to unmask]
or click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
|
