Admin Activity Log

See who changed what in the Magento admin, with the old and new value of every field, every admin sign-in and failed attempt, and the admin sessions that are active right now. Get alerts for suspicious sign-ins and, if you want, limit the admin to a list of IP addresses. This guide covers installation, configuration and day-to-day use.

• Admin demo: https://demo.softawarecommerce.com/try-admin/admin-activity-log
• Changelog: Release notes · Questions: FAQ

1. Requirements

2. Installation

Install with Composer from repo.softawarecommerce.com. The access keys are in your account on softawarecommerce.com; see Composer access for details.

composer config repositories.softaware composer https://repo.softawarecommerce.com
composer config --auth http-basic.repo.softawarecommerce.com PUBLIC_KEY PRIVATE_KEY
composer require softaware/module-admin-activity-log
bin/magento setup:upgrade
bin/magento setup:di:compile            # production mode only
bin/magento setup:static-content:deploy # production mode only
bin/magento cache:flush

To update later: composer update softaware/module-admin-activity-log, then the same bin/magento commands.

Logging starts straight after installation. The admin menu has Softaware > Admin Activity Log with Admin Actions, Login Log, Active Sessions and Settings.

3. Settings

Stores > Configuration > Softaware > Admin Activity Log (also Softaware > Admin Activity Log > Settings). All settings are global (default scope).

General

Exclusions

Security Notifications

Copy a template under Marketing > Email Templates to change its wording, then select your copy here.

Admin IP Allowlist

An enabled allowlist cannot be saved unless your current IP address is on it (checked with the "Client IP Address From" value saved in the same form). An admin session used from an IP address outside the list is treated as signed out, and the refused sign-in is recorded in the Login Log. If you are locked out anyway (for example after your IP address changed), see section 9.

4. Admin Actions

Softaware > Admin Activity Log > Admin Actions lists every recorded change, newest first.

What is logged:

• Catalog: products, categories (including moves in the category tree), cart price rules, catalog price rules.
• Content: CMS pages and blocks.
• Customers and sales: customers, orders, invoices, shipments, credit memos, order and document comments.
• System: configuration (path, scope, old and new value), admin users, admin roles and role permissions.
• Mass actions: grid mass actions and the product "Update attributes" action, with the selection and the parameters. Records saved by the mass action are logged individually and linked by the request ID.
• Imports under System > Data Transfer > Import: entity, behaviour, processed rows and the created, updated and deleted counts.
• Command line: configuration changes made with bin/magento config:set (admin page "cli: config:set").

Columns: ID, Time, Admin User, Action (Create, Update, Delete, Move, Mass action, Import), Entity Type, Entity ID, Entity, Changed Fields, IP Address and Details. The grid has keyword search (admin user, entity, entity ID, IP address, admin page, request ID), filters, saved views, a column chooser and Export to CSV or XML. The line above the grid says how long entries are kept, and a warning appears when the action log is switched off.

Entry details

Click View to open an entry. The summary shows the action, the entity with an Open Record link (or Open Configuration Section for configuration), the admin page, time, admin user, IP address and number of changed fields. Below it, Changes lists each field with its old and new value. New records, mass actions and imports show one column of values ("Saved Values", "Mass Action Parameters", "Import Result"). Other changes made in the same request are listed too.

Masked values

Passwords, tokens, API, private and licence keys, passphrases, card fields, hashes, encrypted and obscured configuration fields, configuration paths Magento declares sensitive and paths that look like keys or passwords are stored as ******. Nested mass-action parameters are masked the same way. Very large values are cut to 5,000 characters.

5. Login Log

Softaware > Admin Activity Log > Login Log lists sign-in events, newest first, with time, username, result, reason, IP address, country and browser.

The country column is filled from Cloudflare's CF-IPCountry header when it is present. An unknown username that could be a password typed into the wrong field (7 or more characters with letters and digits, not an email address) is stored partly masked, for example Se*** (masked, may be a password). The grid has keyword search, filters and CSV or XML export.

6. Active Sessions

Softaware > Admin Activity Log > Active Sessions shows every admin who used the admin panel within the session lifetime: username, name, IP address, country, browser, sign-in time and last activity. Your own session is marked "(this session)".

Click Terminate on a row, or select several sessions and use the Terminate mass action. Each asks for confirmation. The admin is signed out on their next click (Magento_Security behaviour). Your own session cannot be terminated; use Sign Out instead.

7. Security notifications

When notifications are on, the module raises an alert for:

• the set number of failed sign-ins from one IP address within the set number of minutes;
• a lockout of an admin account (always);
• a sign-in from an IP address the admin has not used before;
• a sign-in from a country the admin has not signed in from before (Cloudflare only).

Alerts appear in the admin notification inbox (if "Add Admin Notification" is on) and are emailed to the recipients you entered. New IP and new country alerts can also go to the admin user's own email address.

8. Retention and clean-up

The cron job softaware_activitylog_cleanup runs daily at 03:17 and deletes entries older than "Keep Log Entries For (Days)" in batches. Entries that record changes to the Activity Log's own settings are always kept, so switching logging off or shortening the retention stays on record. Magento's cron must be running.

9. Command line

bin/magento softaware:activity-log:clean [--days=N]
bin/magento softaware:activity-log:allowlist
bin/magento softaware:activity-log:allowlist --add=203.0.113.4
bin/magento softaware:activity-log:allowlist --disable

• clean: deletes entries older than the retention period, or older than N days with --days.
• allowlist: shows whether the allowlist is on and the allowed addresses. --add adds an IP address or CIDR range. --disable switches the allowlist off: your way back in after a lock-out.

10. Permissions (ACL)

Under System > Permissions > User Roles > Role Resources > Softaware > Admin Activity Log:

11. For developers

Other modules can have their own entities tracked by adding an item to the types argument of Softaware\ActivityLog\Model\EntityTypeResolver in their di.xml, with the keys class, label, label_fields, extra_fields and ignore_fields.

12. Troubleshooting

13. Uninstall

bin/magento module:disable Softaware_ActivityLog
composer remove softaware/module-admin-activity-log
bin/magento setup:upgrade

Switch the allowlist off before you remove the module. The log tables softaware_activity_log and softaware_activity_log_login stay in the database; drop them yourself if you no longer need the history.