The “check personal message” log entry is not only triggered when an admin checks another user’s PMs, but also when a thread is split into a PM for reasons like derailment or inflammatory posts longhairedboy. It is also logged when an admin converts a topic into a private message, as their browser automatically loads the PM immediately after the operation succeeds riking.
The log entry can also be triggered by service accounts like ‘system’ when doing cleanup, which is caused by webhooks firing when the first post of a topic is destroyed riking. A fix for this issue has been proposed in a commit by vinothkannans.
In general, the log entry is created whenever the content of a PM is visible to an admin who isn’t included on the PM, as confirmed by techAPJ.
Under what circumstances, exactly, does an admin or system account trigger the “check personal message” log entry?
We have found that it doesn’t only happen when an admin actually checks another user’s PMs. It also seems to happen any time a thread is split into a PM for reasons like derailment or inflammatory posts.
Under what other circumstances will this “check personal message” log entry be recorded?
We need to nail this down because there has been a lot of tension surrounding this particular log entry type on my forum.
Is that why sometimes we occasionally see service accounts like ‘system’ in the log as having read a personal message? Possibly when they do cleanup of some kind?
When an admin converts a topic into a private message, their browser automatically loads the PM immediately after the operation succeeds.
The participants in the private message should check the timestamp of the staff action log (which I presume you’re giving to them) to see exactly which posts were visible to the admin, which in this case should be exactly the posts that were previously public.
That’s weird - I can confirm this happening on meta.
This is coming from webhooks that fire when the first post of a topic is destroyed. The log is created before the webhook existence check happens, so it occurs even if no webhooks receive the topic content.