Use Audit Logs
/admin/logs is the administrative traceability hub. It is more than a list of events: it includes real-time updates, risk summaries, detailed before/after review, force logout, and restore actions.
When to Use Audit Logs
- to identify who changed data
- to investigate login failures or security issues
- to review evidence behind refunds, deletes, or stock changes
- to reconstruct a timeline after an operational incident
Read the Summary Cards
The header shows recent summary cards such as:
Critical AlertsLogin FailuresHigh Value Refunds
These cards include trend visualization, not just raw counts.
Read the Real-Time Indicator
A status dot near the header shows socket state:
- green: live connection is active
- gray: disconnected or not receiving
When live updates are active, new logs and critical alerts can update the screen and toast notifications immediately.
How to Use Filters
The filter bar contains a date-range UI, but based on the current code the main lookup logic centers on:
- user
- category
- action type
- search term
Because date-range handling may depend on deployment or API behavior, confirm real behavior in the active environment.
Example categories
SecuritySOAPPOSInventorySystemMarketingBilling
Example actions
CreateUpdateDeleteExportLoginLoginFailedLogoutRefundForceLogoutSyncAdjustment
Read the Table
The audit table typically shows:
- date and time
- user and role
- category
- action
- target
- detail summary
- IP / device
High-severity rows are emphasized so the user can review them first.
What to Review in the Detail Sheet
Opening a row reveals:
- log ID
- action badge
- actor
- target
- summary
- device information
- network or IP information
- location metadata
- before / after diff in JSON form
How to use the diff
- compare values before and after update
- identify exactly which fields changed
- minimize the scope of a correction response
Actions Available from the Detail Sheet
Force Logout
If the related user is available, the admin can trigger a forced logout to cut the active session.
Restore
Delete-related logs may expose a restore action for recovery scenarios.
Warning: Restore and force logout are sensitive actions. Use them as controlled operational responses, not as casual buttons during investigation.
Reason for Change
The codebase includes ReasonForChangeModal, which supports reason-required update patterns. Operationally, that is a good policy for sensitive edits.
When to Export
- external audit response
- incident report attachment
- evidence storage for a specific user or event set
Practical Tips
- never conclude from audit logs alone without checking the target screen context
- stock issues are clearer when reviewed together with Record Stock Adjustments and Withdrawals
- payment issues should be reviewed together with POS and receipt context, not only the log itself