Can I rely on "value.real_user_id" in CD2?

[aasmund_kvamme]

We want to do some statistics on the use of "Act as ...", and try to do this by checking the CD2 web_logs (/dap/query/canvas_logs/table/web_logs/data).

When we look in the column "value.real_user_id" we get hundreds of lines for users who do not have the "Users - act as" permission. How can this happen? Until a good explanation I can't trust the column "value.real_user_id"?

We can find all rows with the word "masquerade" in the column "value.url", and as far as I have seen this is much more reliable?

Have I misssed something here? Any help is appreciated!

[kyle_cole]

Hey @aasmund_kvamme 

Without doing some digging, my initial thought is that some of those values in real_user_id could be coming from support. When necessary, support will act as a user to try and replicate the issue. 

Have you tried comparing the real_user_id to the canvas.users table? That should help clear up who is acting as a user in your instance.

[stimme]

In addition to instances where the real_user_id is for an Instructure Support worker, the logs will include Student View usage with teachers, TAs, and designers identified by real_user_id acting as Test Student users. 

If you want to filter that out or label it, you can get the user_id values for test students with a query like:

SELECT u.id
FROM canvas.users u 
JOIN canvas.enrollments e ON e.user_id = u.id 
WHERE e.type = 'StudentViewEnrollment';