Verified on release 3.0.74.2 "Accounting for Kazakhstan" (edition 3.0).
In the morning you open the database, and yesterday's "Sale" of 2,320,000 ₸ is gone. Or the opposite — the amount in the document is not the one you entered. Or a user complains: "The program threw an error and crashed." At such a moment you need one answer: who did what and when. This is exactly what the "Registration Log Analysis" report shows. It is not an accounting document — it does not create postings and does not calculate taxes. It is a utility tool for the administrator and the chief accountant for investigation: it reads the registration log (a log of all actions in the database) and breaks it down by users, events, and errors.
1. Purpose
The report parses the registration log — the built-in log where 1C writes every login to the database, creation/modification/deletion of data, posting of documents, errors, and warnings. The report is needed to find who made a change, reconstruct the chronology, gather error statistics, and understand who worked and from which computer.
2. Where to find it
Path in the interface:
Administration → Maintenance → Registration Log → in the opened log form, the "Registration Log Analysis" button (or the item Reports → Registration Log Analysis, if you have the administration section enabled in the command interface).
It is faster to open the report directly in 1C like this: menu "Tools and settings" (gear icon at the top right) → Functions for the technical specialist → Follow the navigation link and paste:
e1cib/list/Отчет.АнализЖурналаРегистрации
Access to the report is available only to a user with administrator rights or with the role for viewing the registration log. A regular accountant may not see this item — this is normal.
2a. How to find out your release
Menu "Help" → "About" (or the "?" icon in the upper right corner). In the opened window you will see two lines: the platform version (for example, 8.3.24.xxxx) and the configuration version — "Accounting for Kazakhstan, edition 3.0 (3.0.74.2)." The instruction below has been verified specifically on release 3.0.74.2. On adjacent releases the names of buttons and fields match.
3. How to fill it in
There is nothing to "fill in" here in the sense of document details — you set the selection parameters and click "Generate." Let's go through each field: what it is for and what happens if you get it wrong.
| Field | What it is for | What happens with an incorrect value |
|---|---|---|
| Period (MANDATORY) | Date and time boundaries for which the log is read | Too wide a period — the report takes minutes to generate and produces thousands of rows; too narrow — you miss the needed event. Set the exact day ± a couple of hours |
| Users | Selection by a specific employee | Leave it empty — you will see everyone, hard to find the needed one. Specify the wrong one — the investigation goes astray |
| Importance (event level) | Information / Warning / Error / Note | Leave only "Error" — you will not see regular actions (edits, deletions). To find edits you need "Information" |
| Events | Action types: Данные.Изменение, Данные.Удаление, Данные.Проведение, Сеанс.Начало, Сеанс.Завершение, etc. |
Without selection — "noise." For "who deleted" set Данные.Удаление, for edits — Данные.Изменение |
| Metadata (object) | Restriction to a specific object: for example, Документ.РеализацияТоваровУслуг |
If you don't set it — you'll have to manually search for the needed document among all catalogs and registers |
| Data / data representation | Selection by a specific object (by the representation string, for example the document number) | Helps go straight to the needed record |
| Computer / Session / Application / IP address | Where exactly the work was done (thick client, web, server) | Useful when the same account is logged in from different workstations |
| Comment / content | Event text | Free selection by substring, if you know part of the error message |
| Report variant | How to group the result: by users, by events, error summary | Does not affect the selection, only the appearance |
After configuring — the "Generate" button. The settings can be saved with the "Save variant" button so you don't have to set the selection each time.
⚠️ The report reads the registration log, not the current database data. If the log has already been trimmed (configured to be kept for a month) — you physically won't find old events, they are already gone.
4. Worked example
Situation. The counterparty sent an act for 2,320,000 ₸ (incl. VAT 16% — 320,000 ₸). In your database the document "Sale of Goods and Services" dated September 5, 2026 has disappeared. The question for accounting — where did it go and why did the balance on accounts 1210 and 6010 "drift."
Actions in the report:
- You open Administration → Maintenance → Registration Log → Registration Log Analysis.
- Period: 05.09.2026 00:00 — 06.09.2026 09:00.
- Events:
Данные.Удаление. - Metadata:
Документ.РеализацияТоваровУслуг. - Generate.
Report result (example row):
| Date, time | User | Event | Data | Computer |
|---|---|---|---|---|
| 05.09.2026 14:32:07 | Ivanova A. | Данные.Удаление | Sale of G&S 0000123 dated 05.09.2026 | BUH-02 |
Conclusion: the document for 2,320,000 ₸ was deleted by Ivanova A. at 14:32 from computer BUH-02. Then you re-create the sale, and the sale document itself will generate the usual postings of the Kazakhstan chart of accounts:
| Dr | Cr | Amount, ₸ | Content |
|---|---|---|---|
| 1210 | 6010 | 2,000,000 | Income from sales (excl. VAT) |
| 1210 | 3130 | 320,000 | VAT payable 16% |
| 7010 | 1330 | (cost price) | Write-off of the cost of goods |
Note: these postings are made by the sale document, not by the report. The report only helped find who deleted the record and when. It itself generates no postings.
5. Types of operation (analysis variants)
The report has no "types of operation" like a document, but it provides several analysis breakdowns — switched via the report variant and the selection:
- By users — who performed how many actions, the most active accounts.
- By events — how many logins, changes, deletions, postings there were.
- By metadata objects — which documents/catalogs were edited most often.
- Error summary — only "Error" and "Warning" level events with text.
- Session chronology — logins/logouts, computers, applications (thick client, web client, background job).
6. What is generated upon generation
Honestly: nothing in accounting. The report:
- does not create postings and does not touch accounts (1210, 3130, 6010, etc.);
- makes no movements in accumulation and information registers;
- does not issue electronic documents — neither ESF in the IS ESF, nor SNT;
- does not change database data.
It only reads the registration log files (in a file database — the 1Cv8Log folder, in a client-server one — the log on the server) and displays a tabular result on the screen. This is safe: you can generate the report as many times as you like without spoiling anything.
7. Printed forms
The utility report has no separate regulated printed form. The result you:
- print with the standard command (printer icon / Ctrl+P) — the generated tabular document itself is printed;
- save via "More → Save" into formats: Excel (.xlsx/.xls), PDF, MXL (1C tabular document), HTML, text;
- send by email directly from the report form, if an account is configured.
For an internal memo or a response to a request, a PDF or a screenshot with the date, user, and event is usually enough.
8. Common mistakes
"Error reading the registration log" / "Failed to open the registration log."
The log is corrupted or locked. Close extra sessions, for a file database check the 1Cv8Log folder; if necessary, recreate the log through the configurator (Administration → Registration Log Setup).
The report is empty, although the event definitely occurred. Three reasons: you missed the period (account for the time, not just the date); the log retention period has expired and the records have already been deleted; the registration of the needed level is disabled in the registration log setup (for example, "Data changes" are not written). Check Administration → Registration Log Setup — which events are recorded at all.
"Access rights violation" when opening the report. The user has no role for viewing the log. Log in as administrator or add the right.
The report generates very slowly / hangs. The period is too wide and without selections. Narrow the dates, add a selection by user or metadata object.
The event exists, but the "Data" column is empty or says "Object not found." The object has already been physically deleted, the reference is "broken." Go by the text representation at the moment of the event and by the comment.
9. FAQ
How to find out who deleted a document?
Period — the day of deletion, event — Данные.Удаление, metadata — the needed document type. The row will contain the user, date, time, and computer.
How to find who changed the amount or date in a document?
Event Данные.Изменение, selection by metadata object or by a specific document via the "Data" field. The log will show the user and the moment of the edit. The log does not store the old field values themselves by default — it records the fact of the change, not "before/after."
Does the report change anything in the database or in accounting? No. It only reads the log and outputs a table. It creates no postings, no movements, no ESF/SNT.
Why don't I see this report in the menu? No administrator rights or role for the registration log. Contact the database administrator.
For how long are events stored? As long as set in Administration → Registration Log Setup (day/week/month/year/without limitation). Anything older is physically deleted, the report will not restore it.
Can the result be exported to Excel? Yes: More → Save → Excel sheet (.xlsx). PDF, MXL, HTML are also available.
How to see all logins of a specific employee for a month?
Period — a month, selection "Users," events Сеанс.Начало and Сеанс.Завершение. You will see the working time and the computers.
The report does not find the needed event — why? Either a miss on the period/time, or the log retention period has expired, or registration of this event type is disabled in the registration log setup.
Where is the log physically located?
In a file database — the 1Cv8Log folder next to the database; in the client-server variant — on the 1C server. The report accesses it automatically.
Is this the same as the object changes report (version history)? No. Object versioning stores the "before/after" content and is enabled separately. The registration log records the fact itself and the author of the action. For completeness, use both.
10. Related objects
- Registration Log (Administration → Maintenance) — the log itself; the "Registration Log Analysis" report opens from it and is an add-on to it.
- Registration Log Setup — defines which events to record and how long to keep them; directly affects what you can find at all.
- Active users — who is in the database right now (in addition to the session history).
- Object versions / Change history — if you need to restore the previous content of a document, and not just the author of the edit.
- Users and rights (roles) — determine access to the report itself.
How to find out your release
"Help" → "About": there the 1C:Enterprise platform version and the configuration release "Accounting for Kazakhstan, edition 3.0" are indicated. Compare with the release of this instruction.
The manual was prepared and verified on release 3.0.74.2 "Accounting for Kazakhstan" (edition 3.0).