← Years 9–10 Digital Systems

Access logs and audit trails

An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 23, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 56, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 57, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 120, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 90, WA Computer Science ATAR Year 11 — Network Communications — Module 132, WA Computer Science ATAR Year 11 — Cyber Security — Module 112

Understanding Access logs and audit trails in Years 9–10 Digital Systems

What it does: A log entry at an odd hour for that user is a sign of possible misuse that someone reviewing the logs can spot and investigate. Many failed attempts on one account in one minute is a pattern an access log makes visible, which can signal a guessing attack. An access log records the user, the action and the time. It should never store passwords in plain text. Logs are automatic. This makes them more reliable than records people have to write themselves. Logs do not prevent actions. They record them, so users can be held accountable and cannot easily deny what they did.

Common mistakes: An access log must keep its earlier records. It should be opened for APPEND so new entries are added to the end. OVERWRITE would erase the history. Each failed login should add 1 to the counter, so it should be attempts + 1. Subtracting would stop the count from ever reaching 3, and repeated failed logins would go unnoticed.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Access logs and audit trails to a class →

This module's key terms are also in a printable crossword (Modules 13–24) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does an access log record?
Who accessed a system or file, what they did and whenOnly the password each user typed in
Matches
2025-03-14 LOGIN FAILED
↓
The entry is missing the username and the time, so you can't tell who tried to log in or when
Applying
Meanings
Term
access log
Meaning
An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.
Practice
09:01 sam LOGIN SUCCESS
Testing
Gaps
09:14 user=sam action=LOGIN
Check Answer
Spots
1OPEN access.log FOR APPEND
2OPEN access.log FOR OVERWRITE

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Coelacanth' badge — Living Fossil, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does an access log record?
A. Only the password each user typed in
B. Who accessed a system or file, what they did and when ✓
An access log records the user, the action and the time. It should never store passwords in plain text.
2. How is an access log created?
A. Automatically by the system as people use it ✓
B. Only when a user remembers to write an entry by hand
Logs are automatic. This makes them more reliable than records people have to write themselves.
3. A log shows 200 failed login attempts on one account in two minutes. What does this most likely suggest?
A. Someone may be trying to guess the password ✓
B. The user is having a very successful day
Lots of failed logins in a short time is a classic sign of a brute-force or password-guessing attack.
4. Which log entry would help an administrator detect misuse?
A. A student account opening the teachers' marks file at 3 am ✓
B. A teacher opening their own timetable at 9 am
Unusual access, such as the wrong person, file or time, is a sign of possible misuse that logs help to spot.
5. How do access logs support accountability?
A. They stop users from being able to do anything wrong
B. They link actions to a specific user so people are responsible for what they do ✓
Logs do not prevent actions. They record them, so users can be held accountable and cannot easily deny what they did.

Match the Pairs

2025-03-14 09:12 jsmith LOGIN FAILED → A log entry showing a failed login attempt: the date and time, the user and the action
2025-03-14 16:45 mlee DELETE grades.xlsx → A log entry that links a named user to an action on a file at a set time
Using logs to detect misuse: a staff member opens files at 3 am when they never normally work then → 2025-03-15 03:02 tkhan OPEN payroll.csv
Repeated failed logins in a short time can show someone guessing a password → 09:00 admin FAILED, 09:00 admin FAILED, 09:01 admin FAILED
2025-03-14 LOGIN FAILED → The entry is missing the username and the time, so you can't tell who tried to log in or when
Log setting: delete all logs every night → Deleting logs each night removes the evidence needed to spot misuse and hold users accountable

Key Term

access log
An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

Fill in the Blanks

1. 09:14 user=sam action=LOGIN FAILED
Hint: Type the result word that shows the login did not succeed
2. IF fails > 5 THEN ALERT admin
Hint: Type the command that warns the administrator about possible misuse
3. who=mia what=DELETE grades.xlsx when=14:03
Hint: Type the field name that records the time of the action
4. log(user, "DELETE", now())
Hint: Type the function name that adds an entry to the access record
5. FOR EACH entry IN log IF entry.result = "FAILED" THEN count ← count + 1
Hint: Type the keyword that loops through each item in the log

Spot the Error

Question 1
A OPEN access.log FOR APPEND
B OPEN access.log FOR OVERWRITE
C WRITE entry TO access.log
D CLOSE access.log
Line B — An access log must keep its earlier records. It should be opened for APPEND so new entries are added to the end. OVERWRITE would erase the history.
Question 2
A IF login = 'FAIL' THEN
B LOG 'failed login', user
C attempts ← attempts - 1
D IF attempts >= 3 THEN LOCK
Line C — Each failed login should add 1 to the counter, so it should be attempts + 1. Subtracting would stop the count from ever reaching 3, and repeated failed logins would go unnoticed.
Question 3
A entry.time ← 'unknown'
B entry.user ← currentUser
C entry.action ← 'opened file'
D WRITE entry TO audit.log
Line A — A log entry records when something happened. The time must be set automatically with NOW(), not left as 'unknown'. Without a real time the log is much less useful.
Question 4
A FOR each entry IN access.log
B IF entry.hour < 6 THEN
C DELETE entry
D END IF
E END FOR
Line C — Logs are used to detect misuse, so odd-hour access should trigger an ALERT for someone to review. Deleting the entry would destroy the evidence.
Question 5
A IF login.result = 'PASS' THEN
B WRITE user, NOW() TO log
C END IF
Line A — This program is meant to record failed login attempts. The condition should check for 'FAIL'. Checking for 'PASS' would log only successful logins and miss the failures.

Student with a class code? Join your class →