The candidate logs page shows the exact action history for one candidate's attempt. Invigilators open it from the invigilation dashboard to see what the candidate did and when. Use this article to understand each column and the action types Cirrus records.
Who can see candidate logs
- Invigilators of a schedule automatically see candidate logs for that schedule.
- Non-invigilators can be granted access by an administrator through Admin > Roles > Site > View user logs. This permission lets the user view logs for any schedule whose hierarchy they belong to. It does not grant invigilator powers: the user cannot pause exams, grant extra time, or perform other invigilator actions.
Open candidate logs
On the invigilation dashboard, select a candidate row. The candidate logs page opens.
Columns
The log table records, per event:
| Column | Meaning |
|---|---|
| Timestamp | Time and date of the action. |
| Attempt | Attempt number. Use the drop-down to switch to a different attempt for the same candidate. |
| Action | What the candidate did. See the list below. |
| Question number | Position of the question in the attempt. |
| Item ID | The library Item ID. |
| Error | Any front-end error captured at that moment. |
| IP address | The candidate's IP at the time of the action. |
Action types
A typical attempt produces this sequence of actions:
- Page visited for the welcome page.
- Exam started when the candidate selects Start assessment.
- Question visited when the candidate opens the first question.
- Question answered (client side): the candidate has answered.
- Candidate save answer (server side): the answer was received and stored.
- Question visited / answered / save answer repeating across questions. For Essay, the client-side message may appear multiple times if the candidate revises the answer before the next save.
- Exam completed when the candidate confirms hand-in.
- Page visited for the finish page.
Other actions you may see:
- Page visited: any non-question page (welcome, finish, NDA, registration form, source-file viewer).
- Question visited: candidate opened a question.
- Question answered: client-side confirmation that the answer was entered.
- Candidate save answer: server-side confirmation that the answer was stored.
- Exam paused / Exam resumed: invigilator action recorded against the candidate.
- Extra time granted: invigilator action.
- Heartbeat lost / restored: connectivity events recorded by the heartbeat monitor.
- Browser inspector detected or left full screen: integrity events from Proctorio or Safe Exam Browser.
- Exam completed: candidate confirmed hand-in.
- Voided: an invigilator or marker voided the attempt.
Reading the logs
Use the logs to:
- Investigate connectivity issues (look for heartbeat events, gaps between Question answered and Candidate save answer).
- Confirm a candidate completed the exam as expected.
- Triage appeals by checking timestamps against the schedule window and the exam timer.
- Cross-reference the IP address column with the Candidate results export (see the cheat indicator).