Breadcrumbs

Proctoring Acs Log guide

Applies to

  • Administrators

Prerequisites

  • Access to the Data Explorer feature in TAO Portal.

  • Knowledge of the Proctoring Acs Log entity.

Purpose

This document provides a practical guide to the ProctoringAcsLogs datastore in Data Explorer. This entity supports post-exam test taker analysis. Its purpose is to help to understand what type of evidence each datastore contains and how that information can be used to reconstruct a test taker’s behavior during an exam session. 

The guide focuses on the most relevant fields for analyzing progress, interactions, responses, technical issues and proctoring-related incidents. 

How to access the data

  1. Open Data Explorer module.

  2. In the ‘Data Setup: Configure or Load’ dropdown list, select Proctoring Acs Log.

  3. In the ‘Filters’ tab, filter by the test taker’s ‘login’ field or by ‘deliveryExecution Id’ (represents the concrete exam session for a test taker in a given delivery).

  4. Click Generate.

proctoringacslogscreenshot.png

Datastore ProctoringAcsLogs details

proctoringAcsLogs stores operational and incident-related logs generated during a proctored assessment session. Its purpose is to provide a detailed audit trail of what happened during test delivery from a proctoring and monitoring perspective.

The dataset typically combines three kinds of information:

  1. test taker activity and security events

  2. Proctoring incidents and monitoring outcomes

  3. Technical delivery and frontend diagnostics

Overall, proctoringAcsLogs is best understood as a session-level monitoring and audit datastore. It helps administrators, analysts, support teams, and proctoring reviewers reconstruct what happened during an exam by linking:

  • who triggered the event,

  • what action occurred,

  • when it happened,

  • in which delivery/session/item context,

  • and why it was logged.

The actor field can mainly be:

  • test-taker: actions or incidents triggered by the test taker during the exam.

  • proctor: proctoring decisions or incident terminations recorded by the proctoring system/workflow.

  • system / deliver-fe: technical frontend delivery logs.

The values in action, reasonCode, and reasonMessage depend strongly on the actor.

Most relevant fields and description

Field

Description

Data example

action

The event or operation recorded in the log entry. Its meaning depends on the actor.

start, navigation, submission, flag, log, terminate

actionStatus

The recorded status of the action. It indicates whether the event succeeded or is simply being logged as an interaction state.

succeeded, interacting

actor

The entity that generated the log entry. 

test-taker, proctor, deliver-fe

deliveryExecutionId

Unique identifier of the specific delivery execution, meaning the concrete exam session for a test taker in a given delivery.

3kabcde#7e1e404b4db8#763959b4c136e4259999db894d6026ac7bfa1aab#4001

deliveryId

Identifier of the delivery or test in which the event occurred.

7e1e404b4db8

incidentTime

Timestamp when the event or incident occurred.

2026-04-16T08:02:23.592Z

ip

IP address associated with the event. 

109.136.127.57

issuerIdentifier

Identifier of the system or issuer associated with the event.

https://portal-epso-prod.prod.gcp-eu.taocloud.org

itemId

Identifier of the item

ES12345V

last_update_date

Timestamp when the log record was last persisted or updated.

2026-04-16T08:36:14.060Z

login

Actor’s username.

n00123456

messageId

Unique technical identifier of the logged message or event.

18631618716937143

name

Human-readable name of the test taker when available.

John Smith

reasonCode

Numeric or coded reason associated with the event. Its interpretation depends on the actor and event type.

20999

reasonMessage

Human-readable explanation of the reason for the event. This is one of the most informative fields in the logs.

[Disable Right Click] Test taker tried to use right click menu.

resourceLink

Identifier or reference associated with the protected resource, session, or proctoring context. 

ef1db113-fa66-4c16-9396-470b300eec18, CPT0001063ContingencyVNAR

status

Current status of the session or interaction at the time of the log.

interacting, closed

tenantId

Identifier of the tenant where the event was stored.

4001

test taker

test taker username. If the Actor is the test taker, this field and Login field contain the same value.

n00123456

Actors

1. Test-taker actor

Common actions for test-taker

Action

Description

start

The test taker started the session or entered an initial exam/proctoring screen.

navigation

The test taker moved between screens, test parts, or items.

submission

The test taker submitted or closed the exam/session.

flag

A test taker-triggered security or monitoring event was detected.

Common reason codes for test-taker

Reason code

Description

Typical reason message

20999

Security-policy or proctoring-policy violation triggered by the test taker.

Right click disabled, screenshot prevention, forbidden command

Common reason messages for test-taker

Reason message

Interpretation

[Disable Right Click] Test taker tried to use right click menu.

The test taker attempted to open the context menu, but this action was blocked and logged.

[Disable Commands] Test taker tried to use a forbidden command: \paste`.`

The test taker attempted to use a blocked keyboard/browser command such as paste.

[Disable Commands] Test taker tried to use a forbidden command: \copy`.`

The test taker attempted to copy content during the exam.

[Disable Commands] Test taker tried to use a forbidden command: \cut`.`

The test taker attempted to use cut, which was blocked by security rules.

[Prevent Screenshot] Test taker tried to take a screenshot.

The system detected a screenshot attempt and logged it as a security event.

2. Proctor actor

Common actions for proctor

Action

Meaning

terminate

A proctoring incident or monitored state was closed/finalised with a classified reason.

resume

Only present in prerequisite test, manual action allowed for support agents

Common reason codes for proctor when action is terminate

Reason Code

Reason Message

0

Disconnected from Proctorio, if enabled. For more information, see How does remote proctoring work in TAO.

1

The attempt ended when the test taker submitted the exam

2

Test taker navigated away from the exam.

4

Left exam when in full screen

5

Ended screen recording

6

Test taker uninstalled Proctorio Extension.

7

Switched to a proxy during the exam

8

Changed networks during the exam

9

Closed or reloaded the exam tab

12

Test taker attempted to modify the quiz page

13

Test taker attempted to download the quiz page

14

Battery died

15

Test taker plugged in an additional monitor.

16

Unplugged a camera or microphone

21

Page became unresponsive during the exam

23

The attempt ended when the test taker exceeded Proctorio 8-hour time limit

24

Test taker revoked the microphone permission

25

Test taker revoked the webcam permission

3. System / deliver-fe actor

Common actions for system / deliver-fe

Action

Description

log

Technical log generated by the delivery frontend.

Common reason codes for system / deliver-fe

Reason code

Description

40999

Technical frontend/runtime/network error logged.