Use Audit Logs

/admin/logs is the administrative traceability hub. It is more than a list of events: it includes real-time updates, risk summaries, detailed before/after review, force logout, and restore actions.

When to Use Audit Logs

• to identify who changed data
• to investigate login failures or security issues
• to review evidence behind refunds, deletes, or stock changes
• to reconstruct a timeline after an operational incident

Read the Summary Cards

The header shows recent summary cards such as:

• Critical Alerts
• Login Failures
• High Value Refunds

These cards include trend visualization, not just raw counts.

Read the Real-Time Indicator

A status dot near the header shows socket state:

• green: live connection is active
• gray: disconnected or not receiving

When live updates are active, new logs and critical alerts can update the screen and toast notifications immediately.

How to Use Filters

The filter bar contains a date-range UI, but based on the current code the main lookup logic centers on:

• user
• category
• action type
• search term

Because date-range handling may depend on deployment or API behavior, confirm real behavior in the active environment.

Example categories

• Security
• SOAP
• POS
• Inventory
• System
• Marketing
• Billing

Example actions

• Create
• Update
• Delete
• Export
• Login
• LoginFailed
• Logout
• Refund
• ForceLogout
• Sync
• Adjustment

Read the Table

The audit table typically shows:

• date and time
• user and role
• category
• action
• target
• detail summary
• IP / device

High-severity rows are emphasized so the user can review them first.

What to Review in the Detail Sheet

Opening a row reveals:

• log ID
• action badge
• actor
• target
• summary
• device information
• network or IP information
• location metadata
• before / after diff in JSON form

How to use the diff

• compare values before and after update
• identify exactly which fields changed
• minimize the scope of a correction response

Actions Available from the Detail Sheet

Force Logout

If the related user is available, the admin can trigger a forced logout to cut the active session.

Restore

Delete-related logs may expose a restore action for recovery scenarios.

Warning: Restore and force logout are sensitive actions. Use them as controlled operational responses, not as casual buttons during investigation.

Reason for Change

The codebase includes ReasonForChangeModal, which supports reason-required update patterns. Operationally, that is a good policy for sensitive edits.

When to Export

• external audit response
• incident report attachment
• evidence storage for a specific user or event set

Practical Tips

• never conclude from audit logs alone without checking the target screen context
• stock issues are clearer when reviewed together with
• payment issues should be reviewed together with POS and receipt context, not only the log itself

Related Docs