> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Location activity log

> Read every location check in TimeTracker: who was checked, what their device reported, the outcome and the reason. The screen to read before enforcing.

The activity log records every location check. It is called **Recent checks** and
it is the screen you read for a week before you switch a rule on.

Go to **Settings → Location rules → Recent checks**.

## What it is

The page describes itself as: *"What each person's device reported, and what we did
about it. Read a week of these before switching a rule from watching to
enforcing."*

One row per check. Newest first.

## Why it exists

A rule that looks right on paper stops half your team on day one,
because of a network range nobody mentioned or a circle drawn 50 metres too
small.

The log turns that from a Monday morning outage into a week of quiet reading.
While a rule is **Watching** it records everything and stops nobody.

## The table

The card is titled **Checks**: *"Newest first. Locations are what each person's
device reported."*

| Column                | What it shows                  |
| --------------------- | ------------------------------ |
| **When**              | The date and time of the check |
| **Person**            | Whose device was checked       |
| **Outcome**           | What was decided               |
| **Why**               | The specific reason            |
| **Reported location** | What the device said           |

## Outcomes

| Outcome                     | Meaning                                                                            |
| --------------------------- | ---------------------------------------------------------------------------------- |
| **At work**                 | The check passed                                                                   |
| **Stopped**                 | The person was away from work and the rule is Enforcing, so the action was refused |
| **Would have been stopped** | Same, but the rule is Watching, so nothing was refused                             |
| **Couldn't check**          | There was not enough information to decide                                         |

<Warning>
  **"Couldn't check" never counts as a pass.** A rule with no networks listed
  returns "Couldn't check" for everyone, which is why an empty rule cannot be
  switched on.
</Warning>

## Reasons

The **Why** column names the exact cause:

| Reason                          | What happened                                                        |
| ------------------------------- | -------------------------------------------------------------------- |
| **At work**                     | Matched a network or a place                                         |
| **Not on an office network**    | The address did not match any range                                  |
| **Network address unreadable**  | The server could not see the caller's address                        |
| **No networks set on the rule** | The rule requires a network but has none listed                      |
| **No location shared**          | The device gave no position                                          |
| **Location too vague to tell**  | The position was less accurate than the ceiling, so it was discarded |
| **Away from every place**       | The position was outside every circle                                |
| **No places set on the rule**   | The rule requires a place but has none listed                        |
| **No check recorded**           | Nothing has been reported yet                                        |

<Tip>
  Read the **Why** column, not just the outcome. "Not on an office network" is a
  missing range. "Location too vague to tell" is someone on a laptop. Those need
  completely different fixes.
</Tip>

## Filtering

The filter above the table has four options:

| Filter             | Shows                                             |
| ------------------ | ------------------------------------------------- |
| **All checks**     | Everything. The default.                          |
| **Away from work** | Only people who were, or would have been, stopped |
| **Couldn't check** | Only checks that could not be decided             |
| **At work**        | Only passing checks                               |

**Away from work** is the one you want during a watching week. Every row in it is
either a rule doing its job or a range you forgot.

## Warning badges

Some rows carry an extra badge about the position that was reported.

| Badge                               | What it means                               | What happened to the position |
| ----------------------------------- | ------------------------------------------- | ----------------------------- |
| **Device reported a fake location** | Android's mock-location flag was set        | Discarded                     |
| **Location was out of date**        | The fix was more than about 90 seconds old  | Discarded                     |
| **Impossible accuracy reported**    | The accuracy figure was nonsense            | Discarded                     |
| **Moved impossibly fast**           | Two checks imply travel faster than any car | Kept, but flagged             |

<Note>
  **Moved impossibly fast** fires for a real flight as well as for a faked one. It
  is a reason to ask a question, not an answer to it.
</Note>

## What is recorded

For each check:

* Who was checked, and when.
* The internet address their connection came from.
* The position their device reported – **kept even when it was discarded**, so you
  can see what was thrown away and why.
* Which rule applied, the outcome and the reason.
* Whether the network matched, whether a place matched, which place, and how far
  away they were.
* Whether the check came from the web app or the mobile app.

## Empty state

Before anything has been recorded:

> Nothing recorded yet. Checks appear here once a rule applies to someone and they
> open the app.

If you see that after assigning a rule, nobody covered by it has opened
TimeTracker yet.

## How to use it before enforcing

<Steps>
  <Step title="Leave the rule Watching for a week">
    A full week catches people who only come in on certain days.
  </Step>

  <Step title="Filter to Away from work">
    Every day. This is the short list that matters.
  </Step>

  <Step title="Ask about each name you did not expect">
    Someone in the office showing "Not on an office network" usually means a
    second internet connection or an IPv6 address you did not add.
  </Step>

  <Step title="Filter to Couldn't check">
    A pile of these is normally desktop users failing a place check. Add a network
    range and set the rule to **Either the network or the place**.
  </Step>

  <Step title="Read the enforce dialog">
    When you click **Start enforcing**, it tells you how many covered people would
    have been stopped in the last 7 days. That number should be the people you
    intended.
  </Step>
</Steps>

## Example

Northwind Studio runs `Studio` in Watching for a week.

| Person        | Outcome                 | Why                        | What Maya does                                                                 |
| ------------- | ----------------------- | -------------------------- | ------------------------------------------------------------------------------ |
| Ana Ferreira  | Would have been stopped | Not on an office network   | Nothing – Ana works from home, this is the point                               |
| Jonas Bergman | Would have been stopped | Not on an office network   | Investigates. He is in the office on IPv6. She adds the IPv6 range.            |
| Sarah Lin     | Couldn't check          | Location too vague to tell | She is on a laptop. Maya sets the rule to **Either the network or the place**. |
| Tom Whitfield | At work                 | At work                    | Nothing                                                                        |

Two of the four rows were bugs in the rule, not people breaking it. That is a
normal first week, and it is exactly why you watch first.

## Permissions

| Action                | Capability                        | Roles        |
| --------------------- | --------------------------------- | ------------ |
| Read the activity log | `location.manage` or `audit.read` | Owner, Admin |

An auditor with `audit.read` can read the log without being able to change any
rule.

## Retention

Checks are kept. There is no automatic purge, so the log builds over time.

## Rate limiting

A person's device is limited to 30 checks a minute. Beyond that they see: *"We're
checking your location too often. Wait a moment and try again – nothing you've
tracked is affected."*

You will not hit this in normal use.

## Common questions

<AccordionGroup>
  <Accordion title="How long should I watch before enforcing?">
    About a week. That covers people who are only in on certain days, and catches
    the weekly patterns a single day misses.
  </Accordion>

  <Accordion title="Why is the log empty?">
    Nobody covered by a rule has opened TimeTracker yet. Checks are recorded when
    people use the app, not on a schedule.
  </Accordion>

  <Accordion title="Does watching mode stop anyone?">
    No. It records what would have happened and refuses nothing.
  </Accordion>

  <Accordion title="Can I see one person's checks?">
    The filter is by outcome. Filter to **Away from work** and read down the
    **Person** column.
  </Accordion>

  <Accordion title="What does Couldn't check actually mean?">
    Not enough information to decide. A discarded position, a missing address, or
    a rule with nothing configured. The **Why** column names which.
  </Accordion>

  <Accordion title="Are the raw positions kept even when discarded?">
    Yes, deliberately. Otherwise a "Location too vague to tell" row would tell you
    nothing about what actually happened.
  </Accordion>
</AccordionGroup>

## Troubleshooting

**Everything says "Couldn't check".** Either the rule has no networks or places
configured, or your hosting is not passing the real network address through. The
**Why** column distinguishes the two.

**People in the office show as away.** They are on an address you have not listed.
IPv6 is the usual culprit.

**A name appears that should not.** Check the **Who this affects** table on the
main settings page. Precedence is person, then group, then role, then everyone.

**No rows for someone you assigned.** They have not opened TimeTracker since the
assignment started. Check the assignment's start date too.

## Related guides

<CardGroup cols={2}>
  <Card title="Location rules overview" icon="map-pin" href="/location-rules/overview">
    The concept and what it cannot see.
  </Card>

  <Card title="Create a location rule" icon="plus" href="/location-rules/create-a-policy">
    Watching, then enforcing, step by step.
  </Card>

  <Card title="IP restrictions" icon="network-wired" href="/location-rules/ip-restrictions">
    Fixing "Not on an office network".
  </Card>

  <Card title="GPS restrictions" icon="location-dot" href="/location-rules/gps-restrictions">
    Fixing "Location too vague to tell".
  </Card>

  <Card title="Location permissions" icon="shield" href="/location-rules/location-permissions">
    Who can read the log.
  </Card>

  <Card title="Roles and capabilities" icon="key" href="/concepts/roles-and-capabilities">
    `location.manage` and `audit.read`.
  </Card>
</CardGroup>