How to Use Recent Actions in a Telegram Group

history Where it is and what it holds

In a large group's menu, administrators have an entry usually called recent actions. Opening it gives a reverse-chronological list of administrative events: messages deleted or edited, members removed or restricted, permissions changed, settings altered, links created and revoked, invitations used.

Two properties make it more useful than a list of labels. It names who did each thing, which is the question you actually have. And for a deleted message it holds what the message said, so removing something does not remove the evidence of what was removed.

It is visible only to administrators — members cannot see it, and nobody is notified that you are reading it. And it cannot be cleared: there is no control for tidying it up, and that absence is deliberate, since a log an administrator could erase would be worth nothing during exactly the incident it exists for.

person_search Anonymity stops at this screen

Step 063 covers posting as the group rather than as yourself. It is a genuine feature with legitimate uses, and it has one boundary worth knowing on both sides of the badge.

Anonymous to members, not to the log. An administrator who posts or acts anonymously still appears in recent actions under their own account. Members cannot tell who removed their message; the owner can.

That is the right arrangement and it is worth telling your moderation team about explicitly. It means anonymity protects somebody from being argued with personally in public — which is its honest purpose — without creating a place where actions have no author.

It also cuts the other way, and moderators deserve to hear it plainly: everything you do in a room you moderate is attributed. Not to shame anybody, but because a moderator who understands that the log exists behaves like somebody whose work is reviewable, which is how this job should be done.

smart_toy The use nobody thinks of: checking the automation

Most writing about audit logs imagines catching a rogue human. In practice the entries you will read most often were produced by a bot, and that is where this screen earns its keep.

A moderation bot added as an administrator acts continuously and silently. The only way to know what it has actually been doing — how much it removes, whether it is catching spam or catching a member with an unusual name, whether it restricted somebody for a week when you expected an hour — is to read its entries in the log.

This matters for the anti-spam setting in Step 061 as well. An automatic filter that removes messages you never see is a filter whose false positives are invisible to you and extremely visible to the member it silenced. They will assume a person censored them, and without the log you cannot even say whether they are right.

The habit is small: after adding any automation, read the log the next day. Once a month after that. It is the difference between running a moderated community and hosting somebody else's software.

touch_app Try it now — five minutes

Four steps. The first is the one that matters, because a screen you have opened once is a screen you remember in a crisis.

1. Open recent actions in a group you administer From the group menu. Read a day of it, even an uneventful one, so you know what normal looks like.
2. Filter by one administrator Including yourself. Seeing your own week of actions listed is a useful calibration for how much moderation is actually happening.
3. Find a deleted message and read it This is the capability people do not expect. Knowing that deletion is not concealment changes how you handle disputes.
4. If a bot moderates your group, read what it did yesterday Look specifically for removals you would not have made. That is the only way to discover a filter that is quietly wrong about your community.

emergency Reading it during something that is actually happening

The log is most valuable on the worst day, which is exactly when nobody wants to learn an unfamiliar screen. A short procedure is worth having in advance.

Stop the bleeding before investigating. If an account is doing damage right now, remove its rights first. You lose nothing by doing so — the log keeps everything it has already recorded, and the entries do not depend on the person still being an administrator.

Then filter, rather than scroll. Narrow to the administrator in question, or to the kind of event. In a busy community the unfiltered stream is unreadable and the filtered one answers the question in seconds.

Read for the pattern, not just the incident. The entry you came for is rarely the whole story. Somebody who deleted one message they should not have will usually have a normal-looking history around it; somebody whose account has been taken will have a burst of unrelated actions in a few minutes. Those two look completely different in the log and require completely different responses.

Copy anything that matters, immediately. The window is short. Screenshots of the relevant entries, taken while you are looking at them, are the only version that survives to next week — and if the incident involves a person rather than a mistake, that record is what you will need when the conversation happens.

Finally, and least technically: tell the community something. A room where forty messages disappeared and nobody said anything fills the silence with its own explanation, which is invariably worse than the truth. One line acknowledging that something happened and is being dealt with prevents the version that spreads in private messages.

link It records how people arrived

One category of entry gets overlooked and turns out to be the most useful in ordinary times rather than in emergencies: invitation links.

The log records links being created and revoked, and it records members joining through them. Combined with the ability to name a link when you make it — the practice from Step 041 — that turns a set of links into an attribution system with no tracking of any kind.

Make one link for the channel description, one for a newsletter, one for an event, each named. Then the log tells you which door people actually came through. It is more honest than analytics, because it counts arrivals rather than clicks, and it is entirely contained within the room.

It also has a moderation use. A wave of accounts arriving through one link, within minutes of each other, is a pattern that stands out immediately — and the response is narrow: revoke that link. Everybody who joined legitimately stays, and the route is closed. Step 066 covers links that expire or limit themselves, which is the durable version of the same idea.

help Common questions at this stage