Audit Logs

Overview

The Audit Logs module provides a comprehensive record of all administrative actions performed in your system. Every significant action—creating users, updating settings, deleting content, assigning roles—is automatically logged with details about who performed the action, when it occurred, what changed, and from which IP address.

Audit logs are essential for accountability, troubleshooting, compliance, and security investigations. They help you understand what happened in your system, track down issues, and identify suspicious activities.

Accessing Audit Logs

Navigation path: Dashboard > Audit Logs

Required permission: system.logs

Key Features

• Comprehensive Activity Tracking: Automatic logging of all administrative actions
• Detailed Log Entries: User, action type, timestamp, IP address, and change details
• Advanced Filtering: Filter by action, user, date range, type, and search terms
• Statistics Dashboard: Visual overview of activity patterns and trends
• Export Functionality: Download filtered logs as CSV for analysis
• Change Tracking: View before/after values for updates
• Real-time Monitoring: See activities as they happen

Main Interface

Statistics Cards

At the top of the page, four cards display key metrics:

1. Total Actions (30d): Total number of logged actions in the last 30 days
2. Most Active User: User who performed the most actions
3. Most Common Action: The action type that occurs most frequently
4. Today's Activity: Number of actions performed today

These statistics help you quickly understand activity patterns and identify unusual behavior.

Active Filters Display

When filters are applied, a blue banner shows which filters are active with the ability to clear individual filters or all filters at once.

Audit Logs Table

The main table displays audit log entries with the following columns:

Desktop View:

• ID: Unique log entry identifier
• Action: Type of action performed (create, update, delete, etc.)
• Type: The type of resource affected (User, Role, Page, etc.)
• User: Who performed the action
• Description: Human-readable description of what happened
• IP Address: IP address from which the action was performed
• Date: When the action occurred (relative time)
• Actions: View details button

Mobile View:
Displays cards with the most important information in a compact format.

Action Badges

Actions are color-coded for quick identification:

• Green (Create): New resources created
• Blue (Update/Sync): Resources modified or synchronized
• Red (Delete/Denied): Resources deleted or access denied
• Cyan (Assign): Permissions or roles assigned
• Yellow (Revoke/Remove): Permissions or roles removed
• Gray (Other): Other actions

Filtering and Searching

Opening the Filter Modal

Click the Filters button in the top right to open the filter modal.

Available Filters

Action Filter:

• Filter by specific action types (create, update, delete, assign, revoke, etc.)
• Shows only actions of the selected type

Type Filter:

• Filter by resource type (User, Role, Permission, Page, Setting, etc.)
• Shows only logs related to that resource type

User Filter:

• Filter by specific user who performed actions
• Useful for reviewing a particular user's activity

Search:

• Free-text search in log descriptions
• Searches across all description text

Date Range:

• Date From: Show logs from this date forward
• Date To: Show logs up to this date
• Use both to define a specific time period

Applying Filters

1. Open the filter modal
2. Select your desired filters
3. Click Apply Filters
4. The table updates to show only matching logs

Clearing Filters

• Click Clear in the filter modal to reset all filters
• Click Clear All in the active filters banner
• Click individual filter badges to remove specific filters

Bulk Actions

The audit logs system supports bulk operations for managing multiple log entries at once. This is useful for archiving old logs or cleaning up unnecessary entries.

Archiving Logs

Archiving logs marks them as archived without deleting them. Archived logs can be filtered out from the main view but remain in the database for compliance purposes.

To bulk archive logs:

1. Select multiple log entries using checkboxes
2. Click the Archive Selected button
3. Confirm the action
4. Selected logs are marked as archived

Result: Logs are archived and can be filtered separately.

Unarchiving Logs

You can restore archived logs back to active status.

To bulk unarchive logs:

1. Filter to show archived logs
2. Select the logs you want to restore
3. Click the Unarchive Selected button
4. Confirm the action
5. Selected logs are restored to active status

Result: Logs are visible in the main view again.

Deleting Logs

Permanently delete log entries when they're no longer needed. Warning: This action cannot be undone.

To bulk delete logs:

1. Select multiple log entries using checkboxes
2. Click the Delete Selected button
3. Confirm the deletion (you'll be asked twice for safety)
4. Selected logs are permanently removed

Result: Logs are permanently deleted from the database.

Automated Cleanup

The system includes a command for automatically cleaning up old archived logs:

# Delete archived logs older than 90 days (default)
php artisan audit-logs:cleanup-archived

# Delete archived logs older than 180 days
php artisan audit-logs:cleanup-archived --days=180

# Preview what would be deleted without actually deleting
php artisan audit-logs:cleanup-archived --dry-run

Scheduling Automated Cleanup:

Add this to your app/Console/Kernel.php schedule:

// Clean up archived logs older than 90 days, monthly
$schedule->command('audit-logs:cleanup-archived --days=90')
    ->monthly();

API Endpoints for Bulk Actions

For programmatic access, the following API endpoints are available:

Bulk Archive:

POST /admin/audit-logs/bulk-archive
Content-Type: application/json

{
  "ids": [1, 2, 3, 4, 5]
}

Bulk Unarchive:

POST /admin/audit-logs/bulk-unarchive
Content-Type: application/json

{
  "ids": [1, 2, 3, 4, 5]
}

Bulk Delete:

DELETE /admin/audit-logs/bulk-delete
Content-Type: application/json

{
  "ids": [1, 2, 3, 4, 5]
}

Delete Old Archived:

DELETE /admin/audit-logs/delete-old-archived
Content-Type: application/json

{
  "days": 90
}

All endpoints require the system.logs permission and return a JSON response:

{
  "success": true,
  "count": 5,
  "message": "Successfully archived 5 audit log entries"
}

Common Tasks

Task 1: Viewing Recent Activity

1. Navigate to Dashboard > Audit Logs
2. The default view shows all recent activity
3. Review the statistics cards for an overview
4. Scroll through the table to see individual actions
5. Click the eye icon to view details of any entry

Result: You can see what's been happening in your system recently.

Task 2: Investigating a Specific User's Actions

1. Navigate to Dashboard > Audit Logs
2. Click the Filters button
3. Select the user from the User dropdown
4. Optionally, set a date range
5. Click Apply Filters
6. Review all actions performed by that user

Result: You can see everything a specific user has done.

Task 3: Finding All Deletions

1. Navigate to Dashboard > Audit Logs
2. Click the Filters button
3. Select "Delete" from the Action dropdown
4. Click Apply Filters
5. Review all deletion actions
6. Click on entries to see what was deleted

Result: You can see all resources that have been deleted and by whom.

Task 4: Tracking Changes to a Specific Resource

1. Navigate to Dashboard > Audit Logs
2. Click the Filters button
3. Select the resource type from the Type dropdown (e.g., "User")
4. In the Search field, enter the resource identifier (e.g., user name or ID)
5. Click Apply Filters
6. Review all actions related to that resource

Result: You can see the complete history of changes to a specific resource.

Task 5: Exporting Logs for Analysis

1. Navigate to Dashboard > Audit Logs
2. Apply any desired filters
3. Click the Export CSV button
4. The CSV file downloads automatically
5. Open in Excel, Google Sheets, or your preferred tool

Result: You have a CSV file with all filtered log entries for external analysis.

Task 6: Viewing Detailed Log Information

1. Navigate to Dashboard > Audit Logs
2. Find the log entry you want to examine
3. Click the eye icon in the Actions column
4. Review the detailed information:
   • Full description
   • User details
   • IP address and user agent
   • Before/after values (for updates)
   • Related resource information
   • Exact timestamp

Result: You can see complete details about what changed and how.

Task 7: Monitoring Failed Login Attempts

1. Navigate to Dashboard > Audit Logs
2. Click the Filters button
3. In the Search field, enter "failed login" or "login failed"
4. Optionally, set a recent date range
5. Click Apply Filters
6. Review failed login attempts
7. Check IP addresses for suspicious patterns

Result: You can identify potential security threats or users having trouble logging in.

Task 8: Reviewing Today's Activity

1. Navigate to Dashboard > Audit Logs
2. Check the Today's Activity statistic card
3. Click the Filters button
4. Set Date From to today's date
5. Click Apply Filters
6. Review all actions from today

Result: You can see everything that happened today.

Task 9: Archiving Old Logs

1. Navigate to Dashboard > Audit Logs
2. Click the Filters button
3. Set Date To to 90 days ago (or your desired cutoff)
4. Click Apply Filters
5. Review the logs to ensure they can be archived
6. Select all logs using the checkbox in the table header
7. Click Archive Selected
8. Confirm the action

Result: Old logs are archived and hidden from the main view but retained for compliance.

Task 10: Cleaning Up Archived Logs

1. Run the cleanup command via SSH or terminal:

   php artisan audit-logs:cleanup-archived --days=180
   

2. Review the output showing how many logs were deleted
3. Optionally, use --dry-run first to preview

Result: Archived logs older than the specified days are permanently deleted, freeing up database space.

Log Entry Details

When you click to view a log entry, you'll see:

Basic Information

• ID: Unique identifier for this log entry
• Action: Type of action performed
• Description: Human-readable description
• User: Who performed the action (with link to user profile)
• IP Address: Source IP address
• User Agent: Browser/client information
• Timestamp: Exact date and time

Resource Information

• Auditable Type: Type of resource affected
• Auditable ID: ID of the affected resource
• Link: Direct link to the resource (if still exists)

Change Details (for updates)

• Old Values: What the data was before the change
• New Values: What the data became after the change
• Changed Fields: List of fields that were modified

Related Information

• Related Resources: Other resources involved in the action
• Context: Additional context about the action

Understanding Action Types

Common Actions

create: A new resource was created

• Example: "Created user: John Doe"

update: An existing resource was modified

• Example: "Updated role: Editor - changed permissions"

delete: A resource was removed

• Example: "Deleted page: Old Announcement"

assign: A permission or role was assigned

• Example: "Assigned role 'Editor' to user John Doe"

revoke: A permission or role was removed

• Example: "Revoked permission 'users.delete' from role Editor"

role_assigned: A role was assigned to a user

• Example: "Role 'Admin' assigned to user Jane Smith"

role_removed: A role was removed from a user

• Example: "Role 'Editor' removed from user John Doe"

sync: Multiple items were synchronized

• Example: "Synced permissions for role: Editor"

denied: Access was denied

• Example: "Access denied to user management for user John Doe"

Permissions

The following permissions control access to audit logs:

• system.logs: Can view audit logs
• system.logs.export: Can export audit logs to CSV
• system.logs.delete: Can delete old audit logs (if implemented)

Note: Audit log access should be restricted to administrators and security personnel only.

Tips and Best Practices

Regular Monitoring

• Review audit logs at least weekly
• Check the statistics dashboard daily
• Set up a routine for security reviews
• Look for unusual patterns or activities

Security Investigations

• Always check IP addresses for suspicious activity
• Look for multiple failed login attempts from the same IP
• Investigate actions performed outside normal business hours
• Check for bulk deletions or mass changes
• Review actions by recently created or modified accounts

Compliance and Auditing

• Export logs regularly for archival
• Keep logs for your required retention period
• Document your log review process
• Use logs to demonstrate compliance
• Include log reviews in security audits

Troubleshooting

• Use logs to track down when issues started
• Find who made specific changes
• Verify that automated processes are working
• Confirm that permissions are being enforced
• Identify configuration changes that caused problems

Performance

• Use filters to narrow down large result sets
• Export and analyze large datasets offline
• Focus on specific time periods for detailed analysis
• Use the search function for specific terms

Data Retention

• Understand your organization's retention requirements
• Export and archive old logs before deletion
• Balance storage costs with compliance needs
• Consider implementing automated archival

Troubleshooting

Problem: No Audit Logs Appearing

Solution:

1. Verify you have the system.logs permission
2. Check that audit logging is enabled in system settings
3. Verify database connectivity
4. Check application logs for errors
5. Ensure the audit logs table exists in the database

Problem: Can't Find Specific Actions

Solution:

1. Clear all filters and search again
2. Expand your date range
3. Try different search terms
4. Check if the action type is what you expect
5. Verify the action actually occurred (check with the user)

Problem: Export Not Working

Solution:

1. Verify you have the system.logs.export permission
2. Check browser popup blocker settings
3. Try with fewer filters (smaller dataset)
4. Check server logs for export errors
5. Verify sufficient disk space on server

Problem: Too Many Results to Review

Solution:

1. Use more specific filters
2. Narrow the date range
3. Filter by specific users or action types
4. Use the search function
5. Export and analyze in a spreadsheet tool

Problem: Missing Details in Log Entries

Solution:

1. Click the eye icon to view full details
2. Check if the related resource still exists
3. Verify the log entry is complete (not corrupted)
4. Some actions may have limited details by design
5. Check application logs for logging errors

Problem: Suspicious Activity Detected

Solution:

1. Document the suspicious entries
2. Check related log entries for context
3. Verify the user account is legitimate
4. Check IP address location and history
5. Review security events for related incidents
6. Consider disabling the account if necessary
7. Change passwords if compromise is suspected
8. Report to security team or management

Related Modules

• Security Events: Monitor security-specific events and threats
• Security Settings: Configure security monitoring and alerts
• Users: Manage user accounts that appear in logs
• Roles: Review role assignments logged in audit trail
• Permissions: Track permission changes