Introduction:
The purpose of this article is to give an overview of how to track user activity in the Activity Accumulator and how to correlate it to the Tomcat Access Logs for the purpose of investigating inappropriate action such as academic dishonesty or inappropriate actions by privileged Users
Functionality:
Database Access:
Managed Hosting clients
Managed Hosting clients have two options for database access.
1. Advanced System Reporting
https://help.blackboard.com/Learn/Administrator/Hosting/System_Management/Reports/Running_Advanced_System_Reports
2. Open Database (Please reach out to your Account Representative for more information)
SaaS clients
SaaS clients require DDA. Please reach out to your Account Representative for more information on your eligibility.
https://help.blackboard.com/Learn/Administrator/SaaS/Integrations/Direct_Data_Access
Please refer to Article #000072048 for more details.
Advanced System Reporting, Open Database, and Direct Data Access
You can still use the OpenDB guide to get a detailed understanding of those particular tables and what columns it contains.
https://help.blackboard.com/Learn/Administrator/Hosting/Databases/Open_Database_Schema
Activity Accumulator:
The activity_accumulator Database table is used to track most kinds of "GUI" activity in Learn. There are two Activity Accumulators, the main Accumulator and the Stats Accumulator. For more information about it, and the differences please see the help.blackboard.com article "Activity Accumulator."
Using the Course ID, you can run a query as follows to get information about Course access:
SELECT cm.course_id, aa.course_pk1, aa.event_type, aa.user_pk1, u.user_id, aa.data, aa.timestamp
FROM activity_accumulator aa
JOIN users u ON aa.user_pk1=u.pk1
JOIN course_main cm ON cm.pk1=aa.course_pk1
WHERE course_id='somecourse'
ORDER BY timestamp;
If you want to track a single User's access through the entire System:
SELECT cm.course_id, aa.course_pk1, aa.event_type, aa.user_pk1, u.user_id, aa.data, aa.timestamp
FROM activity_accumulator aa
JOIN users u ON aa.user_pk1=u.pk1
JOIN course_main cm ON cm.pk1=aa.course_pk1
WHERE user_id='someuser'
ORDER BY timestamp;
And you get a complete list of activity in the System for that User.
To filter by timestamp:
SELECT cm.course_id, aa.course_pk1, aa.event_type, aa.user_pk1, u.user_id, aa.data, aa.timestamp
FROM activity_accumulator aa
JOIN users u ON aa.user_pk1=u.pk1
JOIN course_main cm ON cm.pk1=aa.course_pk1
WHERE user_id='someuser'
AND timestamp BETWEEN 'YYYY-MM-DD' AND 'YYYY-MM-DD'
ORDER BY timestamp;
It is possible to continue joining additional tables to gather more information, but beware of the increasing load on the Database this may cause.
Tomcat Access Log:
You can also look in the Tomcat access log, which is found in the ...blackboard/logs/tomcat directory.
159.196.152.93 127.0.0.1 connector-99 _2229_1 [18/Jun/2021:01:58:43 -0400] "GET /webapps/blackboard/content/listContent.jsp?course_id=_434_1&content_id=_5825_1&mode=reset HTTP/1.1" 200 21175 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.106 Safari/537.36"
This is a single entry from one of our Test Servers. It starts with the User's IP address, which is absent from the activity_accumulator and has the time and date. After that is a get request for course _434_1 content (Course PK1 of 434 in the course_main database table). After that is some information about the Users System, OS, Browser, etc.
The PK1 makes it easy to correlate activity between the Access Log and the Activity Accumulator. For example, the following Activity Accumulator data correlate to the aforementioned access log entry.
Query:
SELECT pk1, event_type, user_pk1, course_pk1, internal_handle, content_pk1, data, timestamp
FROM activity_accumulator
WHERE user_pk1 = '2229'
AND timestamp = '18-06-2021';
Result:
|pk1|event_type|user_pk1|course_pk1|internal_handle|content_pk1|data|timestamp|
---------------------------------------------------------------------------------------------------------------------
|18979390|COURSE_ACCESS|2229|434|content|5825|Content|18-06-2021 01:58:44|
The Activity Accumulator is System-wide, not appserver-specific. However, the Tomcat logs are appserver-specific. If you are in a loadbalanced environment, be sure to check the logs from all apps.
See also Article #000067253 - Tracking User Activity in the Webserver Logs
Technologies:
While Blackboard, Inc does not endorse third-party-sites, clients report the links below helpful in reading the access log.
