Canvas quiz log: what teachers see, event by event

Quiz log, action log, activity log: what Canvas calls it

People who search for “Canvas logs” usually mean one of three records, and Canvas gives them different names. Knowing which one your instructor opened tells you what it can contain.

• The quiz log in Classic Quizzes. The instructor opens it with a View Log link. Instructure's quiz log guide calls the list inside it the “action log”: each item has a status and a timestamp.
• The View Log in New Quizzes. It sits on the Moderate page, per the Moderate page guide. Instructure's admin guide calls the same screen the “Activity Log”.
• Course activity outside quizzes. Last Activity and Total Activity on the People page, and the course access report. These count page views and participation across the whole course. They are not quiz logs.

Most of this guide is about the first two. The third appears in the table of things the quiz log leaves out.

What a Canvas quiz log looks like (sample)

Instructure describes the Classic log screen in two parts. The session information shows the start date and time of the attempt. The action log below it shows a status and a timestamp for each quiz action, and a Reload icon refreshes it. The sample below uses those status names with made-up times for a five-question quiz. It is an illustration, not a screenshot of a real student's log, and the real Canvas screen looks different.

How to read the numbered lines:

1. The student is on the quiz page and has not answered yet. The log cannot tell whether they read anything.
2. Question #1 was answered at 7:02:41. The instructor can click #1 to see each answer given to it.
3. Question #3 shows as answered at the same second, before the student ever reached it. That is autosave, not the student. Matching is one of the four question types where Instructure says the log is not accurate.
4. The quiz page stopped being the page in focus. The line does not say where the student went.
5. The student came back 42 seconds later. The gap is the only extra fact the pair of lines gives.
6. A second answer to #2. Instructure gives two causes for repeats: the student changed the answer, or autosave generated it.

To watch these lines appear for your own clicks, try our Canvas tab switch test: it runs a mock quiz in your browser and writes the log as you answer, switch tabs and come back.

The four events, one by one

A Classic Quizzes attempt produces one event list, and every line in it carries one of four statuses from Instructure's quiz log guide. There is no tab name, no web address, no application name and no image of your screen.

Viewed (and possibly read) a question

This status “displays when a student is active on the quiz page, but has not answered the question.” The wording is careful: “possibly read”. The log knows the quiz page was active. It does not know whether you read the question or how long you looked at it.

Answered a question

This status displays when a student has answered the question. The instructor can click the question number to see how many times it was answered and each separate answer. When a question shows as answered several times, Instructure gives two causes: the student “changed their answer(s)”, or “the answer was generated by the quiz autosave feature”.

Stopped viewing the Canvas quiz-taking page

This status displays “when a student navigates away from the quiz (closes the browser tab, opens a new browser tab, or navigates to a different program).” It gets its own section below, because it is the line students search for most.

Resumed

This status “displays when the student has returned to the quiz.” A Resumed line after a Stopped viewing line closes the gap. Subtract the two timestamps and you have everything the pair says.

Flagged questions, in the API only

The Canvas Quiz Submission Events API also stores a question_flagged event when you flag a question for review. Instructure's log guide does not list it among the statuses an instructor reads, so treat it as data the API holds, not as a line you will see in the log.

What does “Stopped viewing the Canvas quiz-taking page” mean?

“Stopped viewing the Canvas quiz-taking page” means the quiz page stopped being the page in focus. Instructure gives three examples of what writes it: the student closes the browser tab, opens a new browser tab, or navigates to a different program. Three things the line does not tell your instructor:

• Where you went. The event has no destination. In the API it is a page_blurred event, and its event_data is null.
• Why focus moved. Switching to a music app and switching to a search tab write the same line.
• How long counts. Instructure's guide gives no minimum time. The “15 second” and “30 second” figures you may read online come from a thread in the Instructure Community forum. In it, a user quotes an older answer from a “Community Champion”: the entry “can occur” after clicking out of the quiz for more than 15 seconds, or after being inactive within Canvas for more than 30 seconds. That is a forum answer, not Instructure's documentation, and it does not say that shorter gaps go unrecorded. Our tab-switching guide explains why the 15 second rule is not in the docs.

The timestamps on the Stopped viewing line and the next Resumed line show how long the page was out of focus. That is the full extent of what the pair records.

If you see this line on your own log and you know the reason, tell your instructor what happened and when. The timestamps work in your favour here: they let you match each line to a specific moment, such as the second you closed the tab by mistake.

What the event data contains

Behind the log is the Canvas Quiz Submission Events API. Per its documentation, the quiz-taking page captures events during a quiz session and sends them to Canvas to store. Each event has a type, a timestamp and a field called event_data. The examples in the documentation show what that field holds:

• page_blurred with "event_data": null
• page_focused with "event_data": null
• question_answered with the answer, such as {"answer": "42"}
• question_flagged with the question ID and whether it is flagged

The null matters. A focus event carries only its type and its time. Nothing in it names a tab, a website or an application, so when Canvas shows “Stopped viewing the Canvas quiz-taking page”, that is all the data it has.

Is the Canvas quiz log always on?

Not in every course. Instructure's quiz log guide, updated 2026-09-04, says: “Quiz Log Auditing is currently a course opt-in feature.” The link to view quiz logs appears once the feature is turned on in the course feature options.

Some pages say the log runs for every quiz with no setting to turn on. Instructure's own note says otherwise for Classic Quizzes. The guide does not say whether events are stored in a course where the option is off, so do not read a missing View Log link as proof that no record exists. New Quizzes has its own View Log on the Moderate page, and the Moderate page guide describes no opt-in for it.

Why the log can show answers you never gave

Autosave can write lines you did not cause. Instructure's guide names four question types: Fill-in-Multiple-Blanks, Matching, Multiple Answers and Multiple Dropdown. The log “may show” them “as being answered at the beginning of the quiz.”

The cause is the autosave component. When a student clicks to answer another question, the quiz autosaves the questions and can show them as answered. For those four types, Instructure says “the quiz log does not include an accurate log”, and the autosaved entries “may appear earlier in the quiz log than the order in which the student intentionally answered the questions.” When the instructor opens the answers, the autosaved attempt shows “a null or no answer response”.

So a line saying you answered a Matching question in the first minute, before you scrolled to it, is a known autosave effect. If your log shows one, point your instructor to that note in the quiz log guide.

How a professor opens the quiz log

Classic Quizzes

Per Instructure's guide for instructors, the path is Quizzes, then the quiz, then Options, Show Student Quiz Results, the student's name and View Log. The log starts when the student begins the quiz, so a log can show an attempt still in progress. With several attempts, it shows the most recent one by default, and the instructor clicks an attempt number to open an earlier one.

New Quizzes

In New Quizzes the instructor opens the Moderate tab and chooses View Log. Per the Moderate page guide, that log shows when the student began and completed the quiz, “each event that occurred while the student was taking the quiz”, the time elapsed during each event, and “moments of stopping and resuming the quiz”. An Expand icon can show “details about the student's computer or an answer they selected.” The guide also notes that the completion time on the log may differ from the Moderate page by a few seconds.

New Quizzes log vs Classic quiz log

The Moderate page does more than show logs: the instructor manages accommodations and time limits there, reopens a student's most recent attempt, and can submit an attempt that is still in progress. The Reports tab adds a Quiz and Item Analysis report with statistics such as item difficulty and a discrimination index, once a quiz has at least three submissions. It describes how each question performed across the class, not what one student did. Proctoring lives in neither place. Instructure's log and Moderate page guides describe no camera, microphone or screen recording. Tools such as Respondus LockDown Browser are separate products a school adds, with their own rules; our guide to what Canvas and proctoring tools can detect covers them.

What is NOT in the quiz log

Most worries about the log are about data it never collects. The table below splits two questions: is it in the log, and can anyone at your school see it another way?

Who can see your IP address and session details

Your IP address is not one of the four statuses in the Classic quiz log. New Quizzes is different: its log can hold details about the computer an attempt came from, and who sees them depends on role and on a quiz setting.

• Client IP in the New Quizzes log. Per the Moderate page guide, “Only admins and instructors with the View the Client IP address permission can view the Client IP address”. Instructure's permission reference names it “New Quizzes - view IP address” and says it “allows users to view IP address information on the activity log.” Whether your teacher has it depends on how your school set up roles.
• Multi-session details. The event details show the client IP address, browser session ID, browser and operating system. They exist only if the instructor turned on a setting: “For multi-session activity to be recorded and viewable, the Detect Multiple Sessions setting must be enabled by the instructor,” per the admin guide. The same guide says “The multi session details can only be viewed by admins,” and the Moderate page guide adds that this activity is not visible to instructors.
• You get a notice. Per the New Quizzes settings guide, when Detect Multiple Sessions is on, “students receive a notification if they attempt to continue a quiz in a different session from where they started.”
• IP filter. The same settings page lets an instructor restrict a quiz to IP address ranges with Filter IP Addresses. That controls where the quiz can be taken from.

Outside the quiz, teachers see activity summaries. The People page lists Last Activity and Total Activity per student, and, per the access report guide, the course access report lists the content a student viewed, how many times, how many times they participated, and when they last viewed it. Page views with a remote IP sit at the admin level: the Canvas users API is where that field appears. None of that is part of your quiz log.

Can you delete or clear a quiz log? How long Canvas keeps it

Instructure's guides describe no way for a student to view, edit, clear or delete a quiz log. Clearing your browser history does not reach it either: per the API documentation, the quiz page sends events to Canvas, which stores them.

Retention has a limit. Instructure's quiz log guide states: “Quiz logs are only retained for six months.” After that, a question about an old attempt cannot be checked against the log. If you want to dispute a line, do it inside that window, while both you and your instructor can still open it.

Canvas quiz log and cheating: how instructors read a log

Instructure sets the limit itself: “Quiz logs are not intended to validate academic integrity or identify cheating for a quiz.” Per its quiz log guide, the feature is “designed to help you investigate problems that a student may have in the quiz and gain insight into your quiz questions.” For integrity concerns, Instructure tells instructors to first work with “the academic affairs office, academic technology office, or other office charged with handling academic misconduct matters” at their school.

A gap sits between a “Stopped viewing the Canvas quiz-taking page” line and the next “Resumed” line. Instructure's trigger list is closing the browser tab, opening a new browser tab, or navigating to a different program, and the log never records where the focus went.

So a gap tells your instructor that the page lost focus for forty seconds. It does not tell them what filled those forty seconds. A burst of answers in the first minute can be autosave on the four question types above. If your log looks odd to you, ask your instructor to open it with you.

The extension and the log

Canvas Quiz Solver is a Chrome extension that puts the answer right below the question, inside the Canvas quiz page. You stay on the quiz-taking page instead of opening a second window, you do not copy the question into ChatGPT, and you do not switch programs. So there is no page switch for the quiz log to record as “Stopped viewing the Canvas quiz-taking page”. A web page cannot list the Chrome extensions you have installed, and the quiz log has no field for them.

It works on Classic Quizzes and New Quizzes. You can start free, then it is $14.99 a month. AI answers can be wrong, so check them against your course material. It does not run inside LockDown Browser, and Honorlock can turn Chrome extensions off during a proctored exam.

Support is at support@canvasquiz.com. If you are comparing tools that read earlier attempts, see Canvas Quiz Loader and past attempts.

Sources for this guide, each with the date we last checked it:

• How do I view a quiz log for a student? (updated 2026-09-04), checked 2026-09-25
• How do I use the Moderate page in New Quizzes?, checked 2026-09-25
• How do I view multi-session details in New Quizzes as an admin?, checked 2026-09-25
• How do I manage settings for a quiz in New Quizzes?, checked 2026-09-25
• How do I view reports for a quiz in New Quizzes?, checked 2026-09-25
• New Quizzes - view IP address (permission reference), checked 2026-09-25
• Quiz Submission Events - Canvas LMS REST API Documentation, checked 2026-09-25
• How do I view the course access report for an individual user?, checked 2026-09-25
• Users - Canvas LMS REST API Documentation, checked 2026-09-25
• How do I take a quiz in the Canvas app on my iOS device? and on my Android device?, checked 2026-09-25
• Can “Stopped viewing the Canvas quiz-taking page” in the quiz log reveal cheating? (Instructure Community forum thread, not documentation; origin of the 15 and 30 second figures), checked 2026-09-25
• Respondus LockDown Browser, checked 2026-09-25
• Content scripts, checked 2026-09-25
• Document: visibilitychange event, checked 2026-09-25
• MediaDevices: getUserMedia() method, checked 2026-09-25

Common questions