This tutorial explains what the log records, how to filter it, and how to turn it into a simple, repeatable incident review.

What Recent Actions records

Recent Actions is available in supergroups and channels to admins. It keeps a record of administrative events from roughly the last 48 hours, including:

• Messages deleted by admins or bots (with the original content)

• Messages edited (old and new versions)

• Members joining, leaving, being restricted, banned or unbanned

• Admin rights granted, changed or removed

• Changes to group title, photo, description, username and invite links

• Pinned and unpinned messages

• Changes to permissions and slow mode

It does not record ordinary messages that nobody touched, and it does not keep anything older than about two days. That second point matters: if you want to investigate something, do it quickly or take screenshots.

How to open it

1. Open the group and tap its name to see the profile.

2. Tap Edit (or the pencil icon on desktop).

3. Choose Recent Actions.

On desktop clients the log is often under the group's management menu with the same name.

Filtering: the key to making the log useful

In a busy group the raw log is long. Use the filter button at the top:

• By event type: e.g. only "Deleted messages" or only "Members and admins".

• By admin: show only what one specific admin (or bot) did.

A good habit is to start broad (all events in the time window you care about), then narrow to the specific admin or event type once you see a pattern.

Common investigations and how to approach them

"A member says they were banned for no reason"

1. Filter by Members and search for the person's name.

2. Find the ban or restriction event; note which admin or bot did it and when.

3. Look a few lines above: was a message from that member deleted just before? The log shows the original text, so you can see what triggered it.

4. If it was a mistake, unban, apologize briefly, and note the pattern so it doesn't repeat.

"Messages disappeared"

1. Filter by Deleted messages.

2. Check who deleted them. If it was a bot, the cause is likely a filter rule; if it was an admin, ask them directly.

3. Restore important content by reposting it (the log shows the original text).

"Someone changed the group description / pinned a strange link"

1. Filter by Group info and Pinned messages.

2. Identify the account that made the change. If it's an admin who claims they didn't do it, treat it as a possible compromised account: remove that admin's rights first, investigate after.

"We were raided and need to know who got in"

1. Filter by New members for the time window of the raid.

2. Note the join timestamps; accounts that joined within a minute or two of each other are usually the raid batch.

3. Use this list to ban the remaining accounts that weren't caught yet.

Turning the log into an incident review

For anything bigger than a single mistaken ban, write a short review in your admin chat. A template:

Incident: [one line]
Time window: [start – end, timezone]
What the log shows: [key events, who/what did them]
Impact: [members removed, messages lost, links exposed]
Fixed: [what was restored or reversed]
Prevent next time: [one or two changes]

Five minutes of writing this up saves the next admin from repeating the same investigation.

Using the log to tune your bots

Bots appear in Recent Actions like any admin. Once a week, filter by your anti-spam bot and skim its deletions:

• False positives: legitimate messages deleted. Adjust rules or whitelist trusted members.

• Missed spam: ads deleted manually by humans that the bot let through. These show where your filters are weak.

If you find that most manual deletions are ads written with tricks such as spaced-out letters or look-alike characters, a keyword list will keep losing. A semantic anti-spam bot like Xiabao (@xiabaotg_bot), which is free for group owners, is designed for exactly that kind of disguised ad, and its actions show up in the same log so you can audit them.

Limitations to keep in mind

• 48-hour window: investigate promptly or export screenshots.

• Only admin-visible: regular members can't see it, so they can't verify what happened. Communicate outcomes clearly.

• Not a full chat archive: if you need long-term records, use a logging bot or export chat history from Telegram Desktop.

Quick checklist

• [ ] All admins know where Recent Actions is

• [ ] Incidents are checked within 48 hours

• [ ] Filters used by event type and by admin

• [ ] Short written review for serious incidents

• [ ] Weekly skim of bot actions for false positives and misses

The Recent Actions log turns "something weird happened" into a clear timeline. Used regularly, it also becomes the best data you have for improving your moderation setup.

Keyword / regex filtering

How it works: messages matching listed words or patterns are deleted.

Strengths

• Predictable and transparent: you know exactly why something was removed.
• Zero latency, easy to run yourself.
• Great for fixed, high-confidence strings (a known scam domain, a competitor's handle).

Weaknesses

• Trivially bypassed: inserted spaces, homoglyphs, emoji between characters, text in images.
• False positives grow with the list ("free" in a normal conversation).
• Constant maintenance; the list only ever grows.

Semantic / intent-based detection

How it works: a model looks at what the message is trying to do (promote, redirect, recruit) instead of exact words, often combined with signals like account age, links, buttons, and forwarded sources.

Strengths

• Robust to spelling tricks and rewording.
• Can catch ads with no obvious keyword at all ("DM me for the thing we talked about 👀").
• Less manual list-keeping.

Weaknesses

• Less transparent; you need logs to understand decisions.
• Edge cases in groups where promotion is partly allowed (marketplaces) need tuning.

A quick side-by-side

What actually works: layer them

1. Keep a short keyword list for certain-bad items only.
2. Put semantic detection in front for everything else.
3. Review the deletion log weekly and whitelist mistakes.

For the semantic layer, 虾宝 (Xiabao) is an anti-ad bot that's free for Telegram group owners; it focuses on disguised and rewritten ads, which is where keyword lists fail first. Whatever tool you use, the layered setup is the part that matters.