Quiz Event Log

The Quiz Event Log provides a detailed account of the actions your students took while writing a quiz in eConestoga. This information can help instructors locate potential academic integrity concerns.

Opening a student's Quiz Event Log

You can view a detailed log for any student who successfully submits an attempt to any quiz in your course.

Go to Course Tools -> Quizzes.
Click the arrow beside the name of the Quiz and choose "Grade".
Locate the name of the student whose log you wish to view. Under their name, click Attempt 1 to view their completed quiz.

Near the top of the next screen, click the blue Quizzes Event Log link. The log will open in a new window.

Reading the Event Log

The event log records the timestamp of each time that the student exchanged data with the server. Types of events contained in the log include:

Quiz Entry - The student started the quiz attempt.
Quiz Re-Entry - If the student closes the quiz without submitting, that event will NOT be logged. But if they later re-enter the quiz, that will be logged as a Re-Entry.

A student can Re-Enter an already-started quiz attempt as long as the End Date of the quiz hasn't passed, and their personal timer hasn't run out. If the student has given their login to another person, that person can Re-Enter the quiz even if the first student hasn't closed the quiz, letting both enter answers at the same time.

Quiz Completion - The student submitted the quiz.
Response to Question Saved - Each time the student changes their answer on any question, that question is saved. In the case of written questions, the system saves when the student clicks out of the text box-- it does not auto-save while they write. The system also notes the number of characters saved for written questions.
Page Saved - When the user moves between pages, all answers on the current page are saved.
Page Movement - If the quiz is broken into multiple pages, the system records when they move between pages.

Additional Information

In addition to the time and the event details, you can check boxes at the top right of the log to display two additional pieces of information beside every event:

IP Address - A numeric code, consisting of four sets of numbers, that identifies the Internet connection the user accessed the quiz from.

Important note: IP Address geolocation is not reliable and instructors are encouraged to not look up where in the world IP addresses come from. Any user with a VPN can make their IP address appear to come from anywhere in the world that they want. The information gleaned from IP geolocation is not reliably meaningful and does not help to identify academic integrity problems.

Tab ID - Identifies unique browser tabs or windows in which the quiz attempt was opened. If the student's account had multiple sessions within the same quiz attempt, each will receive a different Tab ID. This can be useful to show activity from multiple users even when both users have the same IP Address (e.g., both are on campus).

Interpreting the Event Log and Drawing Conclusions

Important: The Event Log presents a lot of useful information, and instructors often want to look at the log and straightforwardly answer the question, "Did my student cheat?" However, it's very important to recognize that you can rarely say definitively whether a student cheated based solely on the Event Log. The evidence will often be ambiguous, with the same log potentially pointing equally to both innocent and suspicious behaviours. Information in the event log can be useful for confirming or refuting existing suspicions, but a final determination for whether an academic integrity violation occurred will come down to the balance of probablities (or, whatever is more likely or probable) given the evidence.

With that said, here are some scenarios that often come up in Event Logs, and whether or not they can be considered solid evidence.

Scenario #1 - Different IP Address for an In-Person Quiz

Each campus has a unique and consistent IP Address that applies to anyone using the campus wi-fi. You can find this IP Address any time you're on campus by Googling "What Is My IP Address".

When conducting an in-class quiz, you may direct students to use campus wi-fi and not their own mobile hotspots. If you set this rule, all students using wi-fi will have the same IP Address on the Event Log. Then, if any student appears in the log with an IP other than the campus IP, one of three things likely happened:

The student wrote the quiz on their own hot spot connection. OR,
The student used a VPN that changed their apparent IP address. OR,
The student (or someone else) wrote the quiz from off-campus.

There is no way to distinguish these three situations from IP logs or from any other data in the event log. This is why we recommend setting a class rule that students must use campus wi-fi; this way, if the rule is broken for any of the above reasons, an academic integrity investigation can begin.

Finally, it's important to note that a student merely having the campus IP address in the log does not automatically mean that they wrote the quiz in class. The campus IP is the same anywhere in the building, so a student who wrote from a hallway, an empty classroom, the library, or anywhere else on that campus will have the same IP address as the students who wrote in class.

Scenario #2 - Multiple Tab IDs

Each time a user Enters or Re-Enters the quiz, they are assigned a new Tab ID. E.g., when the student starts the quiz for the first time, that will be logged as Tab 1. If the student (or another person using their account) re-enters the quiz, that re-entry will be logged as Tab 2.

A user having multiple Tab IDs does not automatically mean that we should suspect them of cheating.

An innocent example for multiple Tab IDs would be if a student lost connection and reconnected; all events after the reconnect will be on a new Tab ID. The older Tab ID would never be logged again, as in this example log:

A more concerning example would be if the student provided their login to another person and asked them to write the quiz for them, which is classified as contract cheating. Your student sits in class and pretends to write the quiz, while the other person logs into the quiz at the same time and actually answers the questions. In this case, the Tab IDs will alternate back and forth throughout the quiz, as in this example:

If you notice multiple Tab IDs on a student's attempt, look for this alternating pattern of IDs. This indicates multiple users accessing the quiz at the same time, or the same user accessing the quiz on multiple devices.

Scenario #3 - Questions Answered Too Quickly

When a user saves a Written Response question, the system records how many characters of text were entered. You can use this information, plus the time stamps where each question was saved, to determine if a student entered far more text in a short time than seems possible if they were writing it naturally. E.g., if they spent only a minute on a question but saved hundreds or thousands of characters of text, that may mean they pasted the text from an external source instead of writing it.

Note: The number of characters-per-minute that would be considered suspicious varies depending on the question. If you suspect that a student might have saved too many characters to be a naturally-written answer, look up the quiz event logs for a few other sample students, and note how many characters-per-minute they entered for that question. Then, compare that to the student you are investigating. A difference of double the speed may just indicate a faster typist, but a difference of five times or ten times the characters entered per minute likely indicates pasting.

Note that written questions auto-save when the user clicks out of the answer box; some students will save their answer multiple times while working on it, while others will write their entire answer in one burst before saving. Therefore, a student simply saving a lot of text all at once is not evidence of academic misconduct on its own-- you must compare the time stamps. Entering a lot of text at once may not be evidence of cheating if the time stamps show that it took them many minutes to do it.

Scenario #4 - Student Saved Questions After Leaving Class

When your students write a quiz in class, you can monitor them to make it harder for them to cheat. However, if they are able to leave the class and still write, they can violate the integrity of the assessment in various ways. If you suspect that a student worked on their quiz while outside the classroom, you can check the timestamps on the Event Log, and compare them to the times you recorded the student leaving. If they saved questions while not in the classroom, that likely indicates an Academic Integrity Violation.

Examples:

The student was supposed to submit the quiz before leaving class, but did not. You will see save events after the time you recorded them leaving. You may see a Re-Entry event when they reopen the quiz outside of class.
The student used a second device to answer questions while on a washroom break. In addition to seeing question save events during this time, you will likely also see a Re-Entry event when the second device logged in, and then all events from that device will have a new Tab ID.

Additional help with interpretation

Parsing and interpreting the Quiz Event Log, and trying to reconstruct what might have happened during the quiz from what you see there, is complicated. It requires nuanced analysis, and it is sometimes difficult to draw a single definitive conclusion from what you see in the log.

If you need assistance interpreting what you see in the Quiz Event Log, please come to the eConestoga Support Drop-In, which runs twice every weekday over Zoom. A schedule of drop-in times and a meeting launch button are on the right side of the eConestoga homepage. The support staff in the drop-in will be able to look over your log with you and do our best to assist you in analyzing the data there.

You can also reach out directly to the Academic Integrity Office.