is there a chance to know via the logs who changed the theme (look) in SP 2013?

Question

Found the theme changed and I wanted to check the logs. I do not see any category that might include this action. Any help?

Answer 1

Their is no specific category for this. But you can drill down it by going to IIS logs first.

• check IIS log on SharePoint WFE, search for "/_layouts/15/designgallery.aspx"(this page is where you can change the theme). You will get the User name who access that page and time frame. this is quite easy as compare to ULS logs.
• Another way to check the ULS logs and search for same page(/_layouts/15/designgallery.aspx). this will also tell you the user name.