Hi Steph,

This is a bug,  - Im given to understand it shouldnt (thats not definite!) take too long to fix. 

br,

George.

Hi Steph,

Data on people adding or removing attendees, or deleting entire sessions, should really be in the Site Logs, I agree. We'll try and add that soon.

In the interim if you know approximately when the users attendance was cancelled, and then if you have a sysadmin there with access to the webserver logs, you may be able to discover the IP address of the user who made the changes at least. Depending on how your network is set up that may identify a particular person.

First get the session id

When looking at the attendees of the session in question the url should look like /mod/facetoface/attendees.php?s=123 where 123 will be some number, that's the session id

An admin adding/removing users would look like this in the webserver access logs:

 POST /totara25/mod/facetoface/editattendees.php?s=123

again replace 123 with whatever the actual session id is. It's a bit of a long shot and would only conclusively identify a particular user if your network has fixed IP addresses.