Something went wrong in your Telegram group overnight. Messages are missing, a few long-time members say they were removed, and nobody on the admin team remembers doing anything. Before guessing, open the one tool built exactly for this situation: the Recent Actions log (also called the admin log or event log).
This tutorial explains what the log records, how to filter it, and how to turn it into a simple, repeatable incident review.
What Recent Actions records
Recent Actions is available in supergroups and channels to admins. It keeps a record of administrative events from roughly the last 48 hours, including:
- Messages deleted by admins or bots (with the original content)
- Messages edited (old and new versions)
- Members joining, leaving, being restricted, banned or unbanned
- Admin rights granted, changed or removed
- Changes to group title, photo, description, username and invite links
- Pinned and unpinned messages
- Changes to permissions and slow mode
It does not record ordinary messages that nobody touched, and it does not keep anything older than about two days. That second point matters: if you want to investigate something, do it quickly or take screenshots.
How to open it
- Open the group and tap its name to see the profile.
- Tap Edit (or the pencil icon on desktop).
- Choose Recent Actions.
On desktop clients the log is often under the group's management menu with the same name.
Filtering: the key to making the log useful
In a busy group the raw log is long. Use the filter button at the top:
- By event type: e.g. only "Deleted messages" or only "Members and admins".
- By admin: show only what one specific admin (or bot) did.
A good habit is to start broad (all events in the time window you care about), then narrow to the specific admin or event type once you see a pattern.
Common investigations and how to approach them
"A member says they were banned for no reason"
- Filter by Members and search for the person's name.
- Find the ban or restriction event; note which admin or bot did it and when.
- Look a few lines above: was a message from that member deleted just before? The log shows the original text, so you can see what triggered it.
- If it was a mistake, unban, apologize briefly, and note the pattern so it doesn't repeat.
"Messages disappeared"
- Filter by Deleted messages.
- Check who deleted them. If it was a bot, the cause is likely a filter rule; if it was an admin, ask them directly.
- Restore important content by reposting it (the log shows the original text).
"Someone changed the group description / pinned a strange link"
- Filter by Group info and Pinned messages.
- Identify the account that made the change. If it's an admin who claims they didn't do it, treat it as a possible compromised account: remove that admin's rights first, investigate after.
"We were raided and need to know who got in"
- Filter by New members for the time window of the raid.
- Note the join timestamps; accounts that joined within a minute or two of each other are usually the raid batch.
- Use this list to ban the remaining accounts that weren't caught yet.
Turning the log into an incident review
For anything bigger than a single mistaken ban, write a short review in your admin chat. A template:
Incident: [one line]
Time window: [start – end, timezone]
What the log shows: [key events, who/what did them]
Impact: [members removed, messages lost, links exposed]
Fixed: [what was restored or reversed]
Prevent next time: [one or two changes]
Five minutes of writing this up saves the next admin from repeating the same investigation.
Using the log to tune your bots
Bots appear in Recent Actions like any admin. Once a week, filter by your anti-spam bot and skim its deletions:
- False positives: legitimate messages deleted. Adjust rules or whitelist trusted members.
- Missed spam: ads deleted manually by humans that the bot let through. These show where your filters are weak.
If you find that most manual deletions are ads written with tricks such as spaced-out letters or look-alike characters, a keyword list will keep losing. A semantic anti-spam bot like Xiabao (@xiabaotg_bot), which is free for group owners, is designed for exactly that kind of disguised ad, and its actions show up in the same log so you can audit them.
Limitations to keep in mind
- 48-hour window: investigate promptly or export screenshots.
- Only admin-visible: regular members can't see it, so they can't verify what happened. Communicate outcomes clearly.
- Not a full chat archive: if you need long-term records, use a logging bot or export chat history from Telegram Desktop.
Quick checklist
- [ ] All admins know where Recent Actions is
- [ ] Incidents are checked within 48 hours
- [ ] Filters used by event type and by admin
- [ ] Short written review for serious incidents
- [ ] Weekly skim of bot actions for false positives and misses
The Recent Actions log turns "something weird happened" into a clear timeline. Used regularly, it also becomes the best data you have for improving your moderation setup.
Top comments (0)