Andy Whalen

Creates a log file for network/multisite super admin actions.
The following actions are logged for Super Admin users. WordPress action names are listed in parenthesis:
<ul>
<li>change network settings (update_site_option)</li>
<li>grant super admin privileges (granted_super_admin)</li>
<li>revoke super admin privileges (revoked_super_admin)</li>
<li>upgrade blog (wpmu_upgrade_site)</li>
<li>add blog (wpmu_new_blog)</li>
<li>set blog archived (archive_blog/unarchive_blog)</li>
<li>set blog deleted (make_delete_blog/make_undelete_blog)</li>
<li>set blog mature (mature_blog/unmature_blog)</li>
<li>set blog spam (make_spam_blog/make_ham_blog)</li>
<li>delete blog (delete_blog)</li>
<li>delete user (wpmu_delete_user)</li>
<li>delete user (deleted_user)</li>
<li>change other user’s settings (edit_user_profile_update) [NOTE: doesn’t show diff]</li>
<li>change blog setting (updated_option) [NOTE: may occasionally log annoyingly large diffs]</li>
</ul>
The following actions are logged for ANY user:
<ul>
<li>login (wp_login)</li>
<li>logout (wp_logout)</li>
<li>new user (user_register)</li>
</ul>
Some actions that change data will show what the value was before and after.
Below is an example of a log entry when the user ‘smith’ has changed the Network site name from “WP Local Network” to “WP Local Networks”:
<pre><code>[Tue, 03 Sep 2013 13:45:49 +0000] [smith:1] [update_site_option] [1] [site_name] [(WP Local Network)->(WP Local Networks)] [127.0.0.1] </code></pre>
Each line in the log file will roughly follow the below example. Individual actions may log slightly different information, but the DATETIME, USERNAME, USER_ID, ACTION, and IP_ADDRESS sections should always be populated.
<pre><code>[DATETIME] [USERNAME:USER_ID] [ACTION] [AFFECTED_OBJECT_ID] [DATA_TITLE_OR_KEY] [(VALUE_BEFORE)->(VALUE_AFTER)] [IP_ADDRESS] </code></pre>

Observer

Creates a log file for network/multisite super admin actions.

Daniel Cid

The Trunc Logging plugin gives you visibility to all the activity inside WordPress. Logins, logouts, failed logins, new posts, new 
plugins, etc. Every major activity from WordPress is stored for analysis and forensics purposes.
Tracked actions:
<ul>
<li>Logins</li>
<li>Failed logins</li>
<li>Posts / pages published</li>
<li>Posts / pages trashed</li>
<li>Posts / pages removed</li>
<li>Plugin installed</li>
<li>Plugin activated</li>
<li>Themes installed</li>
<li>Themes activated</li>
</ul>
And much more.

Trunc Logging – Auditing syslog for WordPress


Maybe a biased review, but I use it on all my sites. Nothing better than having good logging showing all of what is happening inside WordPress. 


Use it on all my sites

The Trunc Logging plugin gives you visibility to all the activity inside WordPress. Logins, logouts, failed logins, new posts, new plugins, etc.

Observer vs Trunc Logging – Auditing syslog for WordPress