Can someone please confirm my interpretation of the log entries below? 1. User [log in to unmask] logged into ListServ from IP Address 192.168.1.86. 2. That user was given a validation code of 4B5F2589771FE4A408. 3. User [log in to unmask]<mailto:[log in to unmask]> was removed from a List. 4. That user was removed by 4B5F2589771FE4A408 AUTHINFO(192.168.1.86), who is the user who logged in in Step 1 above. ----------------------- ListServ Log Entries showing a Login and a User Deleted from a List ---------------------------------- 10 Oct 2018 11:32:55 From [ANONYMOUS]: X-LOGIN [log in to unmask] 192.168.1.86 PW=[redacted] 10 Oct 2018 11:32:55 To [ANONYMOUS]: ***OK*** 4B5F2589771FE4A408 ..... skipped lines ........ 10 Oct 2018 11:33:20 To [ANONYMOUS]: [log in to unmask] has been removed from the BlahBlah list. No notification has (...) 10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408 AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) GETCFG: (...) 10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408 AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) WM: LIST (...) 10 Oct 2018 11:33:32 From [ANONYMOUS]: X-LOGCK 4B5F2589771FE4A408 AUTHINFO(192.168.1.86) ORGINFO(192.168.1.86) OWNER(IS (...) 10 Oct 2018 11:33:32 To [ANONYMOUS]: ***OK*** 0 0 0 ..... 125 more users are deleted over the course of the next 21 minutes ...... Thanks, Brent From: LISTSERV Site Administrators' Forum <[log in to unmask]> On Behalf Of Brent Hetland Sent: Friday, October 19, 2018 9:23 AM To: [log in to unmask] Subject: Re: Finding out WHO Deleted Subscribers Thanks KP, I am the ListServ admin (we are a very small business and we only do what we need to, with ListServ). Regarding the owners... There are only 4 owners of this list, but I believe this was done maliciously so I'm first trying to find out what I can, before speaking to them. I'll look in the listserv logs... Thanks, Brent From: LISTSERV Site Administrators' Forum <[log in to unmask]<mailto:[log in to unmask]>> On Behalf Of k p Sent: Friday, October 19, 2018 9:19 AM To: [log in to unmask]<mailto:[log in to unmask]> Subject: Re: Finding out WHO Deleted Subscribers The identity of the actor for the event is find-able in the LISTSERV log, your site administrator could take a look. But the system is designed on the premise that events occur only with proper permission and authentication, and generally isn't subjected to a lot of audit requirements. Is the number of owners, for the list in question, so large that you can't just ask each of them whether they did something to the list last week? On 10/19/2018 7:32 AM, Brent Hetland wrote: Hi All, � I have a list setup to NOT Auto-Delete Subscribers. � Yet in a single day (10/10/2018), 126 Subscribers were deleted from the list. � Q. How can I see WHO did this? � The .changelog file and the CHANGELOG database table simply show me the deleted subscribers and the time they were deleted, but not who deleted them. I can�t believe a product that has been around so long, wouldn�t log the user who performed the action� � Thanks, Brent ________________________________ To unsubscribe from the LSTSRV-L list, click the following link: http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1 ________________________________ To unsubscribe from the LSTSRV-L list, click the following link: http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1 ############################ To unsubscribe from the LSTSRV-L list: write to: mailto:[log in to unmask] or click the following link: http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1