Detective mode

The Detective mode is enabled under the general settings in Settings » Simple History.

Normally each logged event stores only the right amount of information needed to show a useful message for that specific event. This changes when Detective mode is enabled: each event will now store way more information. This information includes:

• PHP file executed, i.e. my-file.php
• Request URI used
• Debug backtrace summary
• User browser agent
• Current $_GET and$_POST payload
• An array with all WordPress filters fired until the event was logged
• The name of any cron job running
• Result from php_sapi_name(), i.e. information about where request was made from: the cli or the web. The result can be many vales, including “apache2handler”, “fpm-fcgi”, “cli-server”, “litespeed”, “cli”.
• WP-CLI command/parameters used

All this information makes it more easy for a developer or security expert to track down exactly where, how, and why something was logged.

Example

Here is a simple example that shows how this information can be useful. Below is a simple message saying that the translations for WooCommerce was updated. A curious person may start to wonder: but how and why was is updated by WP-CLI? With Detective mode enabled a lot of more information that this message has been stored. Let’s klick the date and time of the event to bring up the context data table view.

Here in the context data table we have access to a lot of more information.

We can now see that WP-CLI was used to run WP-cron from the command line using this commandwp cron event run --due-nowand in the backtrace info we can follow the progress in details and see all function called, from initiating WP-CLI to running command on the Language_Pack_Upgrader class.