Your log entries show that [log in to unmask]  logged in to Listserv
website and was assigned the validation code of 4B5F2589771FE4A408 which
was logged to have executed the removal of the user [log in to unmask]

Regards,
Nick

On Fri, Oct 19, 2018 at 10:24 AM Brent Hetland <[log in to unmask]> wrote:

> Can someone please confirm my interpretation of the log entries below?
>
>
>
> 1. User [log in to unmask] logged into ListServ from IP Address
> 192.168.1.86.
>
> 2. That user was given a validation code of 4B5F2589771FE4A408.
>
> 3. User [log in to unmask] was removed from a List.
>
> 4. That user was removed by 4B5F2589771FE4A408 AUTHINFO(192.168.1.86), who
> is the user who logged in in Step 1 above.
>
>
>
> -----------------------             ListServ Log Entries showing a Login
> and a User Deleted from a List            ----------------------------------
>
> 10 Oct 2018 11:32:55 From [ANONYMOUS]: X-LOGIN [log in to unmask]
> 192.168.1.86 PW=[redacted]
>
> 10 Oct 2018 11:32:55 To   [ANONYMOUS]: ***OK*** 4B5F2589771FE4A408
>
> …..  skipped lines ……..
>
> 10 Oct 2018 11:33:20 To   [ANONYMOUS]: [log in to unmask] has been
> removed from the BlahBlah list. No notification has (...)
>
> 10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408
> AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) GETCFG:  (...)
>
> 10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408
> AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) WM: LIST (...)
>
> 10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408
> AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) OWNER(IS (...)
>
> 10 Oct 2018 11:33:32 To   [ANONYMOUS]: ***OK*** 0 0 0
>
> …..  125 more users are deleted over the course of the next 21 minutes ……
>
>
>
> Thanks,
>
> Brent
>
>
>
> *From:* LISTSERV Site Administrators' Forum <[log in to unmask]>
> *On Behalf Of *Brent Hetland
> *Sent:* Friday, October 19, 2018 9:23 AM
> *To:* [log in to unmask]
> *Subject:* Re: Finding out WHO Deleted Subscribers
>
>
>
> Thanks KP,
>
>
>
> I am the ListServ admin (we are a very small business and we only do what
> we need to, with ListServ).
>
>
>
> Regarding the owners… There are only 4 owners of this list, but I believe
> this was done maliciously so I’m first trying to find out what I can,
> before speaking to them.
>
>
>
> I’ll look in the listserv logs…
>
>
>
> Thanks,
>
> Brent
>
>
>
> *From:* LISTSERV Site Administrators' Forum <[log in to unmask]>
> *On Behalf Of *k p
> *Sent:* Friday, October 19, 2018 9:19 AM
> *To:* [log in to unmask]
> *Subject:* Re: Finding out WHO Deleted Subscribers
>
>
>
> The identity of the actor for the event is find-able in the LISTSERV log,
> your site administrator could take a look.
>
> But the system is designed on the premise that events occur only with
> proper permission and authentication, and generally isn't subjected to a
> lot of audit requirements.
>
> Is the number of owners, for the list in question, so large that you can't
> just ask each of them whether they did something to the list last week?
>
> On 10/19/2018 7:32 AM, Brent Hetland wrote:
>
> Hi All,
>
> �
>
> I have a list setup to NOT Auto-Delete Subscribers.
>
> �
>
> Yet in a single day (10/10/2018), 126 Subscribers were deleted from the
> list.
>
> �
>
> Q. How can I see WHO did this?
>
> �
>
> The .changelog file and the CHANGELOG database table simply show me the
> deleted subscribers and the time they were deleted, but not who deleted
> them.
>
> I can�t believe a product that has been around so long, wouldn�t log
> the user who performed the action�
>
> �
>
> Thanks,
>
> Brent
>
>
> ------------------------------
>
> To unsubscribe from the LSTSRV-L list, click the following link:
> http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
>
>
> ------------------------------
>
> To unsubscribe from the LSTSRV-L list, click the following link:
> http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
>
> ------------------------------
>
> To unsubscribe from the LSTSRV-L list, click the following link:
> http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1
>

############################

To unsubscribe from the LSTSRV-L list:
write to: mailto:[log in to unmask]
or click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1