Deleted user covering their tracks via PruneAdminlogTask?

[pwg]

Short story:
What is "PruneAdminlogTask" in the admin log?

Long story:
I have an instance where I hired a freelancer, via this forum, to help with a site build.

It's fair to say, it didn't go well, and we parted on poor terms. Both possibly at fault to some extent.

The freelancer, without any confirmation with me, had moved onto doing extra tasks, badly, and then wanted me to pay 6 times more than the initial estimate.

In the end he was paid twice the top figure of his first quote, and I may not use any of his work.

As a precaution I deleted the user, but had to roll back the site to repair some of the "work" they did. Stupidly on my part, I neglected to re-delete them, and they logged back in, and deleted some code.

We "sorted" some of the issues, but in the admin log, I can see instances where they have tried to login again, and immediately and entry appears in the log, "PruneAdminlogTask"

What is that, and what can I do to stop any further intrusions?

Thanks for any help - it has not been a very enjoyable time trying to deal with it.

Cheers,

Paul

[calguy1000]

The 'Prune Adminlog Task' is a task that happens regularly to stop the admin log from getting too big. It shouldn't be happening that often.

There is a setting in global settings that says what the desired maximum age of admin log entries is.

[pwg]

Thanks calguy1000, so given that it is set to the default (one month) and all dates appear to be there, I don't need to worry that the intruder has actually been able to login, and then cover his tracks?

Cheers,

Paul

[paulbaker]

I recommend you install Notifications and add a notification to email you when there is a failed login event - see here for a how-to from Manuel on Uniq3e's blog:
http://www.i-do-this.com/blog/89/Failed ... ifications

You can also add a notification for a successful login.

You can then spot anyone trying to get in to your admin using old/closed accounts. It's also great to know how often legitimate admins are logging in.

It's one of the modules I always install.

[Rolf]

I always use http://docs.cmsmadesimple.org/general-i ... s#mail-udt

[pwg]

Thanks for the advice guys, and I'm about to install both methods, have a play and see which works best for me.

It has been an interesting experience to say the least.

Cheers,

Paul