We use necessary cookies to make this site work. With your permission we also use Google Analytics to understand how the site is used and Google Ads cookies to measure which of our ads lead to purchases. You can accept all cookies, reject the optional ones or choose which ones to allow. Cookie policy
Choose which cookies you allow. Necessary cookies are always on because the shop cannot work without them. You can change your choice at any time with the "Cookie settings" link.
Needed for the basket, checkout, login and security. They do not track you.
Google Analytics: how many people visit, which pages they read and how they found the site. It sets the _ga cookies and sends usage data to Google.
Google Ads: measures which of our ads lead to a purchase. It sets the cookies _gcl_au and _gcl_aw (90 days) and, when you buy, sends Google the order details and a hashed form of your contact details for matching. See our cookie and privacy policies.
Free Magento 2 admin log and audit trail: field-level change history, admin login history, active session control, security notifications and an admin IP allowlist.
Free
No payment needed, with 12 months of updates.
Add it to your cart and complete the free checkout. Your ZIP downloads and Composer access will be in your account.
No subscription or automatic renewal. Keep using the versions included in your update period. Update and licence details
Composer package commercegears/module-admin-activity-log
"Who changed this price?" is a question every Magento team asks sooner or later, and Magento Open Source keeps no record that answers it (Adobe Commerce has its own action log). This free admin activity log for Magento 2 records who changed what in the admin, field by field with the old and the new value, plus every admin sign-in, the active sessions and alerts for suspicious sign-ins.
bin/magento config:set), admin users and roles, mass actions and imports.You get alerts for repeated failed sign-ins and for sign-ins from a new IP or country, and an optional admin IP allowlist (IPv4, IPv6 and CIDR ranges) with a CLI way back in. Passwords, tokens and API keys are always masked in the log, and a daily clean-up keeps it to the number of days you choose.
Every admin change is recorded with the admin user, time, IP address and the old and new value of each field.
Repeated failed sign-ins, account lockouts and sign-ins from a new IP address or country raise an alert by email and in the admin.
Tracking runs in the admin only, uses data Magento has already loaded and writes the entries in one insert at the end of the request.
All features
Feature tour
01 / 06
Save, Delete and mass actions, named as in Adobe Commerce, with admin user, entity, changed fields and IP address. Filters right under the column headings, keyword search, saved views and CSV or XML export.
02 / 06
Each entry shows exactly which fields changed, with a link to the record and to other changes made in the same request.
03 / 06
Successful and failed sign-ins with the reason, lockouts, sign-ins blocked by the allowlist and sign-outs, with IP address and browser.
04 / 06
Every admin session with IP address, browser, sign-in time and last activity. Terminate one or several; the admin is signed out on their next click.
05 / 06
Choose the failed sign-in threshold and time window, new IP and new country alerts, recipients and email templates.
06 / 06
Switch each log on or off, choose how long entries are kept and whether the client IP comes from the web server or Cloudflare.
Live demo
A full Magento store with the module installed, on Luma and on Hyvä. The admin demo signs you in with one click.
Compatibility
| Magento | 2.4.6 – 2.4.9 |
|---|---|
| Platforms | Magento Open Source and Adobe Commerce |
| Storefront themes | Luma Blank Hyvä |
| PHP | 8.2 – 8.5 |
| Latest version | 2.0.3 |
| composer.json requires | php ~8.2.0||~8.3.0||~8.4.0||~8.5.0 magento/framework ~103.0.6 commercegears/module-core ^2.0 free, installed by Composer with this module magento/module-admin-notification * magento/module-authorization * magento/module-backend * magento/module-config * magento/module-cron * magento/module-email * magento/module-security * magento/module-store * magento/module-ui * magento/module-user * |
Installation
Get it free, create a Composer key in your account, then in the root of your Magento project:
01Add the repository and your key (once per project)
composer config repositories.commercegears composer https://repo.commercegears.com composer config --auth http-basic.repo.commercegears.com PUBLIC_KEY PRIVATE_KEY
02Install the module
composer require commercegears/module-admin-activity-log
03Enable it
bin/magento setup:upgrade bin/magento setup:di:compile bin/magento setup:static-content:deploy bin/magento cache:flush
The last three are only needed in production mode.
Prefer a zip? Every version you are entitled to can be downloaded from My modules. More about Composer access
User guide
The user guide has its own page: how to install Magento 2 Admin Log & Audit Trail, what each option does and how to use it in your store. Written for version 2.0.3; a copy ships with the module.
Changelog
FAQ
Something else on your mind? The developers who wrote the module answer before and after you buy.
Ask a question →Already installed it? Open a support ticket
Changes made in the Magento admin (create, update and delete with the old and new value of each field), every admin sign-in attempt and sign-out, and the admin sessions that are active right now.
Products, categories (including moves in the category tree), CMS pages and blocks, customers, orders, invoices, shipments, credit memos, order and document comments, cart price rules, catalog price rules, configuration, admin users, admin roles and role permissions. Grid mass actions, the product "Update attributes" action and imports under System > Data Transfer > Import are logged too.
Configuration changes made with bin/magento config:set are. Changes through the REST or SOAP API, cron jobs, command-line imports and direct SQL are not. Records that Magento or other extensions write with direct SQL (for example some stock updates) only appear as the mass action that started them.
No. Passwords, tokens, API, private and licence keys, card fields, hashes, encrypted configuration fields and configuration paths Magento declares sensitive are stored as **, so you still see that they changed. A failed sign-in with an unknown username that looks like a password is stored partly masked.
Tracking only runs in the admin area. The diff is built from data Magento has already loaded, the entries are kept in memory and written with one multi-row insert at the end of the request, and nothing is written if the database transaction is rolled back. The storefront is not affected.
90 days by default. A daily cron job deletes older entries in batches; set 0 to keep everything. Changes to the Activity Log's own settings are always kept, so shortening the retention or switching logging off stays on record.
Yes. Under Exclusions choose entity types that are never logged, and list configuration paths (with * wildcards, for example design/*) that are never logged.
A number of failed sign-ins from one IP address within a number of minutes (default 5 within 15), lockouts of an admin account, and sign-ins from an IP address or country the admin has not used before. Alerts go to the admin notification inbox and, if you enter recipients, by email. The new IP and new country alert can also go to the admin user's own email address.
From Cloudflare's CF-IPCountry header. New country alerts and the country column therefore need the store to be behind Cloudflare with IP geolocation switched on.
Yes, under Active Sessions with Terminate (single or mass action). The admin is signed out on their next click. Your own session cannot be terminated; use Sign Out instead.
When the allowlist is on, only the listed IP addresses and CIDR ranges (IPv4 and IPv6) can sign in and use the admin. The module refuses to save a list that does not include your current IP address. If you are locked out anyway, for example after your IP address changed, run bin/magento commercegears:activity-log:allowlist --disable on the server.
Either configure the web server to pass the real visitor IP (for example nginx real_ip with Cloudflare's ranges), or set "Client IP Address From" to Cloudflare. The CF-Connecting-IP header is then trusted only on requests that come from Cloudflare's published address ranges.
Yes. The Admin Actions and Login Log grids export to CSV and XML, with the filters you have set.
Since 1.4.0 the action names follow the Adobe Commerce action log ("Save" instead of "Create" and "Update", "Mass Update" and "Mass Delete" instead of "Mass action", "Login" and "Logout" in the Login Log). bin/magento setup:upgrade converts the stored mass action and order Cancel / Hold / Unhold entries, so filters and exports use the same names for old and new entries.
Magento Open Source and Adobe Commerce 2.4.6 to 2.4.9, PHP 8.2 to 8.5 (Magento 2.4.6: PHP 8.2). The module is admin only.
Yes. Admin Activity Log is free to download from commercegears.com and is installed with Composer like our other modules. It needs commercegears/module-core, which Composer installs automatically.
Support
Need more?
GDPR Data Rights adds consent checkboxes with a consent log, a versioned privacy policy, a privacy tab in My Account and a request desk with a reply timer, with anonymisation that keeps your orders intact.
See GDPR Data Rights →From the blog
The old Magento user guide links now land on Adobe's documentation site. Where the manual is, how to keep a copy, and how to spot the pages that describe features your Open Source store does not have.
Packing from the Magento order grid means opening one order after another to see what is in it. Here is what the grid can show on its own, what it cannot, and a free way to add the missing columns.
When you delete a product, Magento removes its URLs and the page becomes a 404. That is sometimes right and often a waste. Here is how to decide, and how to stop it happening by accident.
Deleting a customer in the Magento admin removes the account but leaves their name and address on every order. What actually happens, and a tidier way to handle data requests.
Bulk price changes are easy to start and expensive to get wrong. Check the selected products, price scope and undo behaviour before running the job.
Paid orders are arriving, but emails or indexes are falling behind. Check the background work before assuming the mail server or catalogue is at fault.