What is an access log?¶

An access log records a request reaching a service and the result the service returned. It can establish that a particular account, session, application or connection requested a named resource; it does not by itself show who operated the client or how long a person used the result.

Define what creates an entry¶

At 14:21, Dave previews tender-notes.docx in Microsoft SharePoint through Edge. The service receives a web request, checks the session's authority for object OBJ-4407, returns the preview and creates an event such as:

time=2026-08-12T14:21:59Z
actor=dave@northstar.example
session=SES-41C2
request_id=REQ-8821
resource=/objects/OBJ-4407/preview
result=success

The important verb is requested. The result establishes that SharePoint served this preview to the recorded session. It does not establish how long the preview remained visible, whether Dave read it, or whether an automated client issued the request.

Failed requests are part of the history¶

Denied and failed entries can establish attempted requests and the service's refusal. Repetition may reflect probing, expired authority, misconfiguration or an application retrying - not repeated human decisions. Compare request IDs, intervals, user-agent strings and later successes before choosing between those explanations.

Connect request to actor carefully¶

An account, session identifier and client can provide a strong technical chain. The IP address identifies the observed connection, which may pass through shared routing, a VPN or corporate gateway. Obtain the corresponding authentication event and the browser or application record from the device to advance personal attribution.