How do I know which person changed the due date on an assignment/quiz

[glparker]

A quiz in a course had it's due date changed from Feb 18th to March 30th.    The teacher insists that they didn't do it, and what I can see in PageViews corroborates this.    

There are no other teachers or TA or designers in this course, so I suspect either the teacher was hacked, or someone with admin privileges to the subaccount made the change.

How can I see who or what changed the due date on this Assignment/Quiz ?   

(The change took place prior to April 20, which was the last time our test instance was refreshed, the due date change is already reflected in the test environment)

Thanks, Glen

[JessicaDeanSVC]

Hi @glparker! Unfortunately I haven't found an easy way to get this sort of information either. What I have done when this occurs is open a support ticket/chat and the Canvas engineers have been able to find that information for me. 

[glparker]

Thanks for the update.   I've done the same, but they just got back to me that their ability to search only goes back 30 days.    Since the date change likely happened about 40 days ago, they are not able to get me this information.  😞   

Very sad.

[JessicaDeanSVC]

Well dang 😣 Keep this post open and hopefully someone will come along with a cool trick for this!

[chriscas]

Hi @glparker,

I'm going to move this over to the Canvas Data group to see if there might be a way to get at data like this with that platform.  It may be too much work for a one-off inquiry, but would be good knowledge for the future.

-Chris

[JamesSekcienski]

@glparker 

Do you have access to the web_logs for Canvas Data 2 from more than 30 days ago?  This would potentially have the record of the request that was made to update to the due date for the quiz and then show who made the request.  However, if you don't currently have access then I think that data is gone since web_logs are only available for the last 30 days.

Since you didn't see evidence of the teacher doing it based on PageViews, it is unlikely that someone made the change by hacking into their account or it would be reflected in the PageViews.

If you have a small enough set of admins that you suspect could have done and have the appropriate permissions to have potentially done it, you could trying auditing each of their PageViews.  However, this may be more effort than it is worth.