Audit Log — admin activity log for OpenCart 2.3, 3.x and 4.x

Audit Log for OpenCart 4.x answers a question that sooner or later comes up in every store with more than one employee: who changed the price, who cancelled the order, who removed access rights, and exactly when it happened.

What gets logged

Admin logins, failed login attempts and logouts; order changes — status, contents, totals, customer data; product changes — price, stock, status; categories, customers, store settings, users and permission groups, installing and removing extensions.

Every entry records who performed the action (user, IP, browser), when, on which entity, exactly what the action was — and, most importantly, a detailed diff of the changed fields in “before → after” format. For permissions, it separately shows which routes were removed and which were added.

Secrets never make it into the log

Passwords, tokens, API keys and salts are masked at the point of recording, not at display time — meaning they physically never reach the database. At the same time, the fact that a secret changed is recorded: you can see the payment module’s key was changed, but not its value. This is a deliberate distinction: a log that stores keys becomes a security hole itself.

Search and retention

The log is filterable by user, entity type, action, date range, IP and free-text search; it has pagination and an entry detail view in a modal window. Retention limits — by entry age and by count — are configurable in the free version; scheduled auto-cleanup and CSV export of the filtered log are part of Pro.

Uninstalling the module removes its events and cron tasks, but doesn’t delete the log table: a log that can be wiped with one click isn’t an evidentiary record.

Free version and Pro

Free: recording of all event types, a log with filters and pagination, entry details with a “before → after” diff, secret masking, control over exactly what gets recorded.

Pro: CSV export of the filtered log, scheduled auto-cleanup (a daily cron removes entries by age and count limit), and logging of order status changes made outside the admin area — storefront checkout, payment gateway callbacks, the order API.

Trial — only on your click. Installing and saving settings activate nothing. If you want to look at Pro, click “Try Pro”, enter your e-mail, and get a 7-day key for this store right away; it’s also sent by mail. No card, nothing auto-renews.

No load on the admin area

Logging never blocks the store: a logging error never breaks a page, and saving with no real changes doesn’t create empty entries. Benchmarks on our demo stand showed no measurable difference in admin speed with logging on versus off.

Version history

1.1.0 (OpenCart 3.x) — the 3.0.x build brought up to the same model as 4.x and 2.3: the licence is verified on the server with a 14-day grace period, the trial is only issued on your own click. Fixed two issues from the 1.0.0 release for 3.x: the very first save of the settings burned a trial period nobody had started, and the event listener showed up as a second “Audit Log” row in the extension list with an “Install” button. An update now re-registers events, so the log doesn’t go silent after replacing files. Product and category names with quotes no longer show up in the log as HTML entities.

1.1.0 — logging works again on OpenCart 4.0.x: all model events moved to the asterisk-based format (on 4.0 the core builds the event with a slash, on 4.1 with a dot, so the previous dot-based listener never fired on 4.0 and the log stayed empty). An order status change from the admin editor is now recorded on both 4.0 and 4.1. Licensing moved to the standard CatCode model: server-side key verification with a 14-day grace period, a trial only on click, a two-tab window. The daily licence check no longer clutters the log with its own entries.

1.0.0 — first release: an admin activity log with a “before → after” diff, filters, secret masking, CSV export and scheduled cleanup.