I'm creating a log with several actions in drupal.

I register similar actions with hook_watchdog.

* Implements hook_watchdog().
function MYMODULE_log_watchdog(array $log_entry) {

  if($log_entry['message']=='Login attempt failed for %user.'){

But I do not know how to detect that is created or deleted a user, and record this information in my custom log.

I'm new in drupal development and I Appreciate any guidance to investigate. Thanks :)

3 Answers 3


You could actually log the details about user creation at hook_user_insert(), and deletion using hook_user_delete().

User creation: Acts on new user creation

function MODULE_user_insert(&$edit, $account, $category) {
  watchdog('user', 'User created with ID: %userid', array('%userid' => $account->uid]), WATCHDOG_NOTICE, $link = NULL);

User deletion: Acts on account deletion

function MODULE_user_delete($account) {
  watchdog('user', 'User having ID: %userid deleted', array('%userid' => $account->uid]), WATCHDOG_NOTICE, $link = NULL);

Keep in mind, the user module already creates watchdog log entries when a user is created or deleted:

User created

watchdog('user', 'New user: %name (%email).', array('%name' => $form_state['values']['name'], '%email' => $form_state['values']['mail']), WATCHDOG_NOTICE, l(t('edit'), 'user/' . $account->uid . '/edit'));

in user_register_submit

User deleted

watchdog('user', 'Deleted user: %name %email.', array('%name' => $account->name, '%email' => '<' . $account->mail . '>'), WATCHDOG_NOTICE);

in _user_cancel

Other user watchdog calls ( filename:line-number)

./user.pages.inc:81:    watchdog('user', 'Password reset instructions mailed to %name at %email.', array('%name' => $account->name, '%email' => $account->mail));
./user.pages.inc:131:          watchdog('user', 'User %name used one-time login link at time %timestamp.', array('%name' => $account->name, '%timestamp' => $timestamp));
./user.pages.inc:171:  watchdog('user', 'Session closed for %name.', array('%name' => $user->name));
./user.pages.inc:450:    watchdog('user', 'Sent account cancellation request to %name %email.', array('%name' => $account->name, '%email' => '<' . $account->mail . '>'), WATCHDOG_NOTICE);
./user.admin.inc:355:      watchdog('file system', 'The directory %directory does not exist or is not writable.', array('%directory' => $picture_path), WATCHDOG_ERROR);
./user.module:616:    watchdog_exception('user', $e);
./user.module:2174:      watchdog('user', 'Login attempt failed for %user.', array('%user' => $form_state['values']['name']));
./user.module:2223:  watchdog('user', 'Session opened for %name.', array('%name' => $user->name));
./user.module:2368:    watchdog('user', 'Attempted to cancel non-existing user account: %id.', array('%id' => $uid), WATCHDOG_ERROR);
./user.module:2419:      watchdog('user', 'Blocked user: %name %email.', array('%name' => $account->name, '%email' => '<' . $account->mail . '>'), WATCHDOG_NOTICE);
./user.module:2430:      watchdog('user', 'Deleted user: %name %email.', array('%name' => $account->name, '%email' => '<' . $account->mail . '>'), WATCHDOG_NOTICE);
./user.module:2485:      watchdog_exception('user', $e);
./user.module:3145:        watchdog('security', 'Detected malicious attempt to alter protected user fields.', array(), WATCHDOG_WARNING);
./user.module:3641:  watchdog('action', 'Blocked user %name.', array('%name' => $account->name));
./user.module:3807:  watchdog('user', 'New user: %name (%email).', array('%name' => $form_state['values']['name'], '%email' => $form_state['values']['mail']), WATCHDOG_NOTICE, l(t('edit'), 'user/' . $account->uid . '/edit'));

An alternative approach would be to look into the Rules module which can intercept various events, such as a watchdog entry, and perform an action, such as emailing someone - all configured via the user interface with export/import functionality and a good API.

Rules can act on the following user events out of the box:

  • After a user account has been deleted
  • After saving a new user account
  • After updating an existing user account
  • Before saving a user account
  • User account page is viewed
  • User has logged in
  • User has logged out

Don't forget about the module Role Watchdog! It will log user delete / user create for you via an entry that shows the 'authenticated user' role being added/removed in concert with the user addition / removal. It also works with og, and is more persistent than the watchdog messages (presuming that you periodically flush your watchdog cache, as most do).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.