Audit Trail - Logging Framework

by Coding 9 GmbH

Rating: no rating ( write a review )

Downloads: <10

Modular audit logging framework for Shopware 6: tracks entity changes and actions through configurable sinks (database, HTTP, Elasticsearch), with an admin UI and a REST API.

Annually €19.00* /month €228.00* /year

Monthly €19.00* /month Cancelable monthly

Compatible with:

6.6.1.0 - 6.7.14.2

Includes:

Free trial month

The subscription starts with a free trial month during which it can be canceled at any time.

All updates

During the subscription all released updates are included for free

Support from the Extension Partner

In case you have any questions or problems with your extension you can always ask the Extension Partner for help during the subscription.

Description

Highlights

Tamper-evident hash chain
Verifiable by command & monitoring
Multi-sink: database, HTTP, Elasticsearch
Admin UI with filters, detail view & export
Optional PII/IP capture, off by default

Features

Central AuditTrailService for all plugins
Entity history tracking for Shopware entities
Configurable multi-sink dispatching
Built-in database and HTTP sinks
Extensible with your own sinks (Elasticsearch, APM …)

Admin grid with filters and detail view
Export of audit logs
REST API endpoint for external querying
Optional PII/IP capture, disabled by default
Low integration effort – a single log(...) call

Show more Show less

About the Extension

The Audit Trail is a modular audit logging framework for Shopware 6. It records changes to entities and security-relevant actions and makes later modification, deletion or truncation of the log provable – a foundation for traceability and forensics.

At its core is an AuditTrailService that any plugin can use with a single log(...) call. Audit data is distributed through a configurable multi-sink dispatching: to the database, to HTTP endpoints, to Elasticsearch or to your own sinks. This lets you tailor logging precisely to your infrastructure.

Entries are written into an append-only hash chain: each entry is cryptographically bound to the one before it, and Shopware rejects any attempt to modify an existing entry. If an entry is altered or deleted, or the end of the log is cut off, it is detected — provably, via bin/console coding9:audit:verify, which exits non-zero and plugs straight into your monitoring. Your retention policy is not mistaken for tampering: what it purges, it puts on the record.

Your benefits

Logs the actions you select — entity changes, logins, orders — and every one of them.
Tamper-evident: modifications, deletions and truncation of the log are detected.
Full traceability – who changed what and when.
Exportable logs for internal and external reviews.
Capturing IP addresses and personal data is optional and off by default.
Low integration effort for your development team.

Feature set

Central AuditTrailService for all plugins.
Entity history tracking for Shopware entities.
Configurable multi-sink dispatching.
Built-in database and HTTP sinks.
Extensible with your own sinks (Elasticsearch, APM and more).
Admin grid with filters and detail view.
Export of audit logs.
REST API endpoint for external querying.
Optional PII/IP capture, disabled by default.
Low integration effort – a single log(...) call.

The Audit Trail is compatible with Shopware 6.6.1 up to and including 6.7 (6.6.0 is not supported).

Details

Available: English, German
Latest update: 28 September 2026
Publication date: 29 September 2026
Version: 1.4.6
Category: Administration

Resources

Reviews (0)

Write a review

If you downloaded this extension you can write a review in the Shopware Account.

Write a review

No reviews found.

About the Extension Partner

Coding 9 GmbH

See all extensions

Partner Status

Shopware
Extension Partner

Details

Partner since: 2023
Extensions: 3

Support

Based in: Germany
Speaks: German, English
Response time: Very quickly

How does the plugin prove the log has not been tampered with?

Every entry is bound to the one before it with SHA-256 (a hash chain), and the newest entry is anchored separately. Shopware rejects any attempt to modify an entry. Altered entries, deleted entries and a truncated log are all detected by "bin/console coding9:audit:verify", which exits non-zero so it can be wired into cron or monitoring.

Could someone with database access still forge the log?

Someone with full write access to the database could in theory recompute every entry and the anchor consistently — no purely local scheme can prevent that. That is what the HTTP and Elasticsearch sinks are for: they take the log off the box, so the database is no longer the only witness.

Does the retention policy interfere with tamper detection?

No. Retention records what it purges, and verification accepts exactly that gap — and reports any other.

Do other plugins need to support audit logging?

No. Any plugin can use the AuditTrailService with a single log(...) call — the framework handles dispatching to the sinks.

Which Shopware versions are supported?

The plugin supports Shopware 6.6.1 up to and including 6.7. Shopware 6.6.0 is not supported.

Does the plugin make my shop legally or GDPR compliant?

No. The audit trail records who changed what and when, and makes later changes to that record provable — that is what it does. It does not assess, guarantee or constitute legal compliance of any kind, GDPR included, and is not a substitute for legal advice. Whether and how you use the log for your own record-keeping obligations is your decision.