Is there any way to tell when a user's password was changed? A user tried to log on today and discovered that his password had mysteriously been changed. All I can assume is that he left his computer unattended and someone changed it.

Is there any way to tell when this happened, so as to narrow down who might have done it? I suspect the answer is "no" - I don't see a watchdog entry, and in /var/log/mysql all there is is an error log, not a log of queries.

Is there another place where DB queries might be logged or is there somewhere else in Drupal I could check?
It is not possible to tell from the database it-self when user changed his password.

The user password in Drupal 7 is stored in users table with the following columns of interest:


pass - User's password (hashed).
access - Timestamp for previous time user accessed the site.
login - Column which tells you timestamp for user's last login.


However there are few workarounds:


If you've got logging enabled (dblog or syslog), Drupal logs when particular user has logged in. This should point you to the IP address (whether it's different as usual).
On live environments, periodical backups of database should be a must. Depending how often you do the backups, compare different dumps focusing on particular user and his password, for example:

gzcat db-dump-2017*.sql.gz | grep -w users | grep -w pass | grep specific_user


Note: Above command attempts to stream compressed dump of database in order to find value of pass column from users table for the given user.

Then check which database dump has the new changed password. From there you can check the logs (e.g. from watchdog table) for this user. Especially check IP addresses, requested URLs and authorization attempts (whether successful or failures).