With that in mind, the logging records user logins you may wasnt to check the otrs log for the user login at the time of the change.
-----Original Message----- From: otrs-boun...@otrs.org [mailto:otrs-boun...@otrs.org] On Behalf Of Holger Erb Sent: Friday, August 21, 2015 8:28 AM To: otrs@otrs.org Subject: [otrs] Ticket History Hello Nick, Ticket-id is the OTRS internal id for a ticket and Ticket-Number is the number of the ticket which an agent will see in the dashboard per example. Ticket-ID will be seen as well in a notification e-mail, the included URL in this e-mail will show at the end the internal Ticket-ID. If you have access to the OTRS database directly, via excel per example, list the content of the table "ticket", the column id contains the internal id of the ticket the column tn contains the number of the ticket You can trust the history of OTRS. If an account gets listed as the initiator of the action "move", you can be sure that this account has done it. But yes, the owner of this user-account could have shared username/password with somebody or somebody has misused the credentials. For the action "Change Owner" - the new owner should get an e-mail notification. Maybe helpful as well If not already done, make sure that the pw gets changed asap for this account. MIT FREUNDLICHEN GRUESSEN / WITH KIND REGARDS HOLGER ERB | IT TEAM LEADER CLIENT SERVICES & COMPLIANCE (GTS) | MSX INTERNATIONAL OFFICE: +4922194700141 | MOBILE: +491638471062 | MAILTO: h...@msxi-euro.com --------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs
