Every entry in the WordPress activity log is an event, in which you can find the details about a change on a WordPress website. Every event type has an Event ID associated to it. This article explains what Event IDs are and how you can use them.
Introduction to Event IDs
The concept of events and event IDs is the same as in the Windows event log: every type of change has an associated event ID. For example whenever a user logs in to WordPress, the event recorded in the WordPress audit log reports which user logged in, from where but will always have event ID 1000.
An event ID is associated with a specific change or action on WordPress, regardless of details of the change. Refer to the list of all the event IDs that are used in the WordPress security audit log to find out which ID is associated with a specific change.
Why are Event IDs used?
Event IDs are like categories, they allow you to better understand and use the information in the WordPress activity log. Here are a few examples of how Event IDs make it easier to do specific tasks.
Search for a specific WordPress change in the audit log
Imagine you need to find the last time the user robin logged in to your website. So if there were no event IDs to “categorize” the information you’d have to search for all events that have the user robin associated with them and then manually review the logs.
With event IDs you can simply search for all events that have the user robin associated with them and then filter the search results by event ID 1000 (WordPress user logged in). The result is a list of all the times user robin logged in to your website.
Easily generate reports of specific changes
Event IDs also make it very easy to generate specific WordPress reports. For example you need to generate a report of all the content changes on a published pages. From the list of event IDs we know that the ID for events that report content changes is 2065. So you can use the following criteria to generate the report:
- Post type is Page,
- Post status is Published,
- Event ID is XXXX (content changes).
Get notified of important changes that happen on your WordPress website
WordPress email notifications also depend on Event IDs. Let’s assume you would like to get notified every time someone does a plugin change, such as installs, activates, updates, deactivates or uninstalls a plugin. From the list of event IDs we know that:
- Event ID 5000 means a plugin was installed,
- Event ID 5001 means a plugin was activated,
- Event ID 5002 means a plugin was deactivated,
- Event ID 5003 means a plugin was uninstalled,
- Event ID 5004 means a plugin was updated.
By configuring the following WordPress email notification trigger you will get an email alert whenever someone installs, activates, upgrades, deactivates and uninstalls a plugin on your WordPress website:
(Event ID is 5000) OR (Event ID is 5001) OR (Event ID is 5002) OR (Event ID is 5003) OR (Event ID is 5004)
The WordPress Activity Log Event IDs
Event IDs are like the core of the WordPress activity log. Without them it would be almost impossible to do searches, generate specific reports and get email alerts for when specific changes happen on your WordPress specific tasks. There is no need to learn them by hearth: whenever you need to search for some specific change in the WordPress audit log, create an email notification or report simply refer to the list of Event IDs for the WordPress audit log and find the IDs you want to use.