All user-initiated configuration updates and edits are logged with enough information for tracking changes. You can see the time, object and the user that updated the configuration.
To view reports of user activity in SDDM navigate to Administration > Audit Log and the Audit Logs page will be displayed.
Batch Updates: The batch update request is logged (with results reported under System Messages) and then the individual updates to included objects are logged separately.
REST API Updates: REST API updates are also logged, the user shown will be based on the authentication used for the REST call.
Security Tracking: This audit log will also show login attempts, both successful and failed attempts. You can see if there are any breech attempts based on users information used. You can also use this log to see if any malicious configuration changes were made by a specific user.
System Messages: Background processes will report results to this log and can be viewed here. Some examples of background processes – discovery jobs and batch updates.
To view a report of system activity in SDDM navigate to Administration > System Messages and the System Messages page will be displayed.
You can click the three dots to the right of the message you are interested in to view additional information.