Check access logs and audit logs, you should see the details something like this, write a simple java code on top of that and get the user from the last 30days based on date field, check below record from access logs. IP Address - UserName 25/Oct/2018:07:47:21 -0400 "GET /bin/publishlistener?