Three warnings from your own log

Nothing new is collected for this. Two of the rules read sign-ins and profile starts the log already holds, over the last thirty days.

The third reads today's profile list instead, because a cluster on one address is a fact about how profiles are set up right now rather than an event that happened.

• Sign-ins

  Who signed in and when, with the address the server itself saw and the country, where a country is known at all.

• Profile starts

  An opening that took the lock on the server. A window opened while the server was out of reach leaves no entry.

• Today's profiles

  The name and the exit address of each profile that has not been deleted.

Either the person travelled or the password is in somebody else's hands. Both are worth the same day rather than the week when profiles start vanishing.

The comparison is per person, not per team. One colleague living in Poland does not make an Argentine sign-in normal for another, and a first sign-in is never an alarm: a newcomer has no usual country yet.

Platforms take a cluster of accounts on one address together, and they need no simultaneous logins to find it. Three profiles is still work; four on one exit is where the line sits.

The three heaviest clusters are named with profile names, so thirty identical lines never bury the one worth reading.

Accounts signing in together read as one script behind all of them, whatever the names on them say. Five starts inside a minute is the count that raises the line.

The count alone is not enough, so the rule looks at density too. A pack is a burst only when the smallest gap between two neighbouring starts falls under two and a half seconds.

The panel sits at the top of your dashboard, and it is absent entirely when there is nothing to say.

A line cannot be dismissed. The cluster line goes when the profiles are spread apart; the other two are read out of the log itself and leave when their entries fall out of the window.

• Most urgent first

  A possible stolen password stands above the housekeeping lines, and equally urgent lines stand newest first.

• Admin and owner only

  Reading the log is their action. A manager, an operator or a member is refused, and the panel stays quiet rather than breaking.

• Through the interface too

  One call returns the same lines to a program key allowed to read logs, and both toolkits carry it.

A line tells you the shape. What actually happened is in the log itself, read three ways over one set of rows.

1. 1

   Everything

   The whole workspace newest first, with the email of the person instead of an internal id.

2. 2

   Openings

   Only the starts and stops of browser windows: the view behind a burst and behind who was working when.

3. 3

   Sign-ins and addresses

   Sign-ins and machine registrations with the address, the country and the machine name.

Each of the three points at a different repair, and no browser setting does any of them for you.

1. 1

   A new country

   Change the password, turn on the second sign-in step and look through the linked machines.

2. 2

   A cluster on one address

   Spread those profiles over more addresses, or keep the cluster knowingly for accounts meant to sit together.

3. 3

   A burst of openings

   Open through the queue or a schedule, so a morning arrives spread out instead of in a row.