MediaWiki Logging & Monitoring — Log Types, Log Search, and Special:Log

In this tutorial, you will learn about MediaWiki Logging & Monitoring. We cover key concepts, practical examples, and best practices to help you master this topic.

Logging and monitoring in MediaWiki records every administrative action through the logging system — from page deletions and user blocks to file uploads and permission changes — with Special:Log providing search and filtering across all log types, the same audit trail Wikipedia relies on for transparency and accountability.

What You'll Learn

• Understanding MediaWiki's logging system
• Navigating Special:Log and its filters
• Exploring different log types
• Searching and filtering log entries
• Using logs for auditing and troubleshooting
• Configuring what gets logged

Why It Matters

Every administrative action on a wiki should be recorded. Who deleted a page? When was a user blocked? Which IP uploaded a suspicious file? The logging system answers these questions. Logs provide accountability, enable auditing, help troubleshoot problems, and give insight into wiki activity. Without logs, administrators cannot investigate issues, track changes, or prove what happened.

Real-World Use

A DodaTech wiki administrator notices a page is missing. They check Special:Log and see the deletion log: "Admin2 deleted DodaSync/Installation on June 27, 2026 at 14:30 — Reason: Outdated content." The admin contacts Admin2, who confirms the page was intentionally removed and provides an updated version. The incident is resolved in 5 minutes because the logs had the information.

Learning Path

flowchart LR
  A["34: REST API"] --> B["35: Database Maintenance"]
  B --> C["36: Logging & Monitoring"]
  C:::current
  D["37: Backup & Restore"]
  E["38: Performance Tuning"]
  F["39: Upgrading MediaWiki"]

  C --> D --> E --> F

  classDef current fill#38bdf8,color#0f172a,stroke-width:2px

The Logging System

MediaWiki automatically logs all administrative actions. Each log entry records:

• Type: What kind of action (delete, block, upload)
• Action: Specific action within the type (delete, restore, revision delete)
• Target: The affected page or user
• User: Who performed the action
• Timestamp: When it happened
• Comment: The reason provided by the user
• Details: Action-specific parameters

Log Storage

Logs are stored in the logging database table. This table can grow large on active wikis but is optimized for fast queries.

Special:Log

Special:Log is the central interface for viewing all logs.

Navigation

Go to Special:Log on your wiki. The page shows:

Log entries
────────────────────────────────────────────────────
2026-06-28 14:30: Admin deleted DodaBrowser (outdated)
2026-06-28 12:15: Admin blocked 192.168.1.100 (spam)
2026-06-28 10:00: Admin uploaded "Screenshot.png"

Filter Options

• Type: Filter by log type (all, delete, block, upload, etc.)
• User: Show logs by a specific user
• Target: Show logs for a specific page or user
• Date range: Start and end dates
• Action: Sub-filter within a type

Passing Parameters in URL

Special:Log?type=delete&user=Admin&page=DodaBrowser

This URL shows all deletion actions by Admin on pages named DodaBrowser.

Log Types

Deletion Log

Records page deletions and restorations:

Action: delete       — Page was deleted
Action: restore      — Page was restored
Action: revision     — Revision was deleted or restored
Action: event        — Log entry was deleted or restored

Each entry shows who deleted the page, why, and the full page title including namespace.

Block Log

Records user blocks and unblocks:

Action: block        — User was blocked
Action: unblock      — User was unblocked
Action: reblock      — Block parameters were changed

Shows the block duration, reason, and whether account creation was disabled.

Protection Log

Records page protection changes:

Action: protect      — Page was protected
Action: modify       — Protection level was changed
Action: unprotect    — Protection was removed

Shows the protection level (semi, full) and expiry for each action.

Upload Log

Records file uploads and deletions:

Action: upload       — File was uploaded
Action: overwrite    — Existing file was updated
Action: revert       — File was reverted to a previous version

Shows the filename, size, and a thumbnail preview.

User Rights Log

Records user permission changes:

Action: grouppermissions — User was added to or removed from groups
Action: rights        — Individual user rights were changed

Shows the old and new groups, and who made the change.

Move Log

Records page moves:

Action: move          — Page was moved to a new title
Action: move_redir    — A redirect was created or deleted during move

Shows the old and new titles.

Import Log

Records page imports:

Action: interwiki     — Page was imported from another wiki
Action: upload        — Page was imported from an XML file

Shows the source of the import and the number of revisions imported.

Merge Log

Records page history merges:

Action: merge         — Page history was merged into another page

Important for tracking when histories are combined during page moves or merges.

Patrol Log

Records when edits are patrolled:

Action: patrol        — Edit was marked as patrolled
Action: autopatrol    — Edit was automatically patrolled

Shows the revision ID and the patrolling user.

Log Search and Analysis

Searching Logs

Use Special:Log with search parameters:

-- Equivalent database query
SELECT log_type, log_action, log_timestamp, log_comment
FROM logging
WHERE log_type = 'block'
  AND log_timestamp > '20260601000000'
ORDER BY log_timestamp DESC
LIMIT 100;

Analyzing Log Patterns

Common analysis questions:

• Who deletes the most pages? Filter by type=delete, group by user
• How many blocks per week? Filter by type=block, aggregate by week
• What is the most common block reason? Review block comments
• Which pages get deleted most often? Filter by type=delete, group by target

Exporting Logs

Logs can be exported for external analysis:

Special:Log?type=block&export=csv

Or via the API:

https://yourwiki/api.php?action=query&list=logevents&letype=block&format=json

Custom Logs

Extensions can add custom log types. For example:

Semantic MediaWiki: smw-log — Changes to semantic data
Echo: echo-log           — Notification events
RenameUser: renameuser   — User renames

Creating Custom Log Entries

Extensions create log entries using the LogPage class:

$logEntry = new ManualLogEntry( 'myextension', 'someaction' );
$logEntry->setTarget( $title );
$logEntry->setComment( 'Log entry comment' );
$logEntry->setPerformer( $user );
$logId = $logEntry->insert();
$logEntry->publish( $logId );

Log Retention and Purging

Automatic Purging

Older log entries are automatically purged if configured:

// Keep logs for 90 days
$wgLogPurgeAge = 90 * 24 * 3600;

Manual Purging

# Purge logs older than 30 days
php maintenance/purgeOldLogs.php --age=30

Archiving Logs

Export logs before purging:

# Export all block logs
php maintenance/dumpBackup.php --logs=block > block-logs.xml

Best Practices

Regular Log Review

• Check deletion logs for unauthorized removals
• Review block logs for consistent enforcement
• Monitor upload logs for inappropriate files
• Audit user rights changes

Log Analysis Schedule

Daily:   Quick scan of recent changes and deletion logs
Weekly:  Review block log and upload log
Monthly: Full log analysis, export to CSV, identify patterns
Quarterly: Purge old logs, archive if needed

Privacy Considerations

Logs contain usernames, IP addresses, and page titles. Consider:

• Who has access to logs (only sysops by default)
• Log retention policies (GDPR Compliance)
• IP address masking in logs

What You Learned

• All administrative actions are logged in the logging table
• Special:Log provides a searchable interface for all log types
• Log types include delete, block, protect, upload, rights, move, import
• Logs can be filtered by type, user, target, date, and action
• Custom log types from extensions extend the logging system
• Regular log review is essential for wiki security
• Old logs can be purged or archived automatically

In the next lesson, you'll learn about backup and restore procedures.

Common Mistakes

Practice Questions

1. What information is recorded for each log entry in the logging system?
2. How would you find all pages deleted by a specific user in the last month?
3. What is the difference between the deletion log and the protection log?
4. Challenge: Build a log analysis system. Review all log types on your wiki. Export the deletion log and block log as CSV. Analyze the data to answer: which user has the most blocks, what is the most common block reason, which day of the week has the most deletions, and how many pages were protected in the last 30 days. Create a "Wiki Activity Report" page that summarizes these findings with tables and charts. Set up a monthly review Process that updates the report.

FAQ

Mini Project

Goal: Implement a comprehensive logging and monitoring system.

1. Review all log types available on Special:Log
2. Generate at least one log entry for each type (delete a test page, block a test user, protect a page, upload a file, change user rights)
3. Search through logs using different filters (by type, user, date range)
4. Export deletion logs as CSV
5. Create a "Log Monitoring" dashboard wiki page with links to filtered log views
6. Document the log types and what each one records
7. Set up a weekly reminder to review the deletion and block logs
8. Test the log purge process by running purgeOldLogs.php with a short age parameter

What's Next

Logs tell you what is happening. Now let's make sure you can recover from disasters with proper backups.

Continue to Lesson 37: Backup & Restore — learn about XML dumps, database backups, file backups, and complete restore procedures.