Audit Log | Admin Audit Trail showing who changed what and when

About the Extension

Friday afternoon, and your best-selling product is suddenly listed at £9.90 instead of £99.00. Four people had access to the admin this week. Nobody remembers touching it. The audit log answers that question in a few clicks, without a round of awkward emails.

The problem

Shopware 6 has no complete change history for the administration that shows the user, the time and the old value in one place. Once several admins, an agency and your ERP all work on the same shop, every oddity turns into guesswork. That costs time. And sooner or later, trust within the team.

The solution

The plugin writes every change a logged-in admin makes to the selected data types into its own log: who, when, which record, and whether it was created, updated or deleted. With the level of detail set to "Field diff (before/after)", each changed field is stored with its old and new value. You find everything under Settings > Extensions > Audit Log, filterable by user, entity, operation and date range.

What's in it for you

Facts instead of finger-pointing. The list shows straight away which user touched the record. One click on the entry shows before and after for every field.

Nobody tampers with the entries. No entry can be edited or deleted through the administration or the Admin API, not even with full administrator rights. A log that anyone can rewrite is worthless. This one isn't.

You decide how much gets stored. Field diff or metadata only, and exactly the entities you care about. Out of the box that means products, orders, customers, users and roles.

Privacy is built in, not bolted on. IP capture is off, anonymisation is on. Passwords, tokens and keys only ever show up as "protected". Once the retention period runs out, a daily task clears old entries.

The log neither slows you down nor quietly fills up. The plugin writes entries in the background through the message queue, so your team keeps working in the admin as usual. Above the list you always see how big the log is. If your server does not run scheduled tasks, the audit log warns you instead of growing unnoticed for months.

Your ERP imports too, if you want them. Switch on logging for integrations and you also see changes coming in through an API connection. Large syncs are processed in batches of 500 entries.

How the plugin works

• It records actions from the administration and, if enabled, from API integrations. Changes made by customers in the storefront, console commands and background processes are left out.
• Each entry holds the timestamp, user, entity, record ID and operation: Created, Updated or Deleted.
• The detail view lists the field changes with before and after. When a record is deleted, the entry keeps its last state.
• You set the retention period in days. The default is 90 days, 0 means keep indefinitely.
• "Maximum number of entries" sets an upper limit. Above it, the daily cleanup deletes the oldest entries, even if their retention period has not run out yet. The default is 0, meaning no limit.
• Above the list, "Log size" shows the number of entries, the oldest entry, retention period, entry limit and the last cleanup. If the automatic cleanup falls behind, you see a warning there.
• If you open an order in the administration and cancel the edit, nothing ends up in the log. Saved changes and status changes appear as "Updated".
• You control who can see the log through the "Audit Log" permission in role management. Out of the box, only administrators see it.
• A notice in the plugin configuration points out employee data protection, so you can settle that before switching it on.

Typical use cases

A wrong price on a bestseller. Filter by the entity product and the date range, open the entry. You see who changed the price, when, and from which value to which.

An agency works in your admin. Your agency maintains categories and products. Add categories to the audited entities, and from then on you see which of their users created, updated or deleted what.

Your ERP overwrites stock levels. Your ERP syncs overnight through an API integration. With integration logging on, you can tell whether a stock level came from the import or was changed by hand.

A customer asks you to erase their data. Your developer runs one console command that removes every log entry for exactly that customer and leaves the rest of the log untouched.

Technical facts for your IT team

• Shopware 6.7, PHP 8.2 or later.
• One dedicated table, swp_audit_log. Shopware's own tables stay unchanged.
• The plugin does not send any data to external servers.
• If a user or integration is deleted, the plugin only clears the reference. The stored name stays in the entry.
• Asynchronous writes through the message queue, in messages of at most 500 entries. Without a running worker, entries appear later accordingly.
• A daily scheduled task deletes entries past the retention period and above the entry limit, also in batches of 500. A large backlog is worked off in follow-up message queue messages of at most 50,000 entries each, so no single run hits a timeout.
• Draft versions, such as an order opened in the administration, are not logged, only the saved live version.
• Field values longer than 5,000 characters are truncated. Fields with names such as password, token, secret, hash or apiKey are never stored in plain text.
• IP capture is optional. Anonymisation removes the last octet of IPv4 addresses and keeps only the 48-bit network prefix of IPv6 addresses.
• Admin API: read yes, create, update and delete are rejected. Deletion only happens through the retention period and the console command swp:audit-log:purge-entity, which has a dry-run option.
• No storefront code: no effect on your theme, HTTP cache or page load times.
• Configuration applies shop-wide, not per sales channel.
• Uninstalling removes the table and the task, unless you choose to keep the plugin data.

To be honest

The plugin shows you the old value, but writing it back is up to you. This version does not record translatable texts such as product name or description as field changes, it does not log logins, and there is no CSV export. If you need a certified archive for tax or statutory record-keeping, look elsewhere: the log is protected against changes through the admin and the API, not against someone with direct database access.

Legal notice

We accept no liability for legal requirements. Please check the use of this plugin with a qualified legal advisor.