Configuration

← Overview

Open Add-ons → Manage add-ons → Admin Activity Log & Audit Trail → Settings. The settings apply to the whole installation (all storefronts).

General

Setting	Default	Description
Record activity	On	Off: nothing new is recorded and no alerts are sent. The existing log stays readable.
Record actions from	Admin panel, Vendor panel, REST API	Where actions are recorded. Vendor panel applies to Multi-Vendor. Console and cron is off by default because those jobs are usually automated (imports, feeds).
Field-level diffs for	All	The objects whose changes are stored with old and new values: products, categories, orders, users (with user groups and privileges), settings, add-ons, payment methods, shipping methods, promotions, vendors/storefronts.
Log every admin form submission	On	Also records form submissions that change no tracked object, for example the block manager, pages, taxes or languages. Off: only tracked changes and sign-ins are logged.
Log sign-ins and sign-outs	On	Successful and failed sign-ins to the admin and vendor panels, sign-outs and “Act on behalf of” sessions.
Vendors see the activity of their own staff	On	Multi-Vendor only. Vendors get an Activity log page and History tabs with the actions of their own administrators.

Privacy and masking

Setting	Default	Description
Store request parameters	Masked values	What is kept of the submitted form data: Masked values, Parameter names only or Nothing. Secrets are always masked.
Also mask fields containing	empty	Extra words, one per line. Parameters whose name contains one of them are stored as ******.
IP addresses	Full address	Anonymized replaces the last part of the address with zero (203.0.113.0); Do not store keeps no IP address.

Always masked: parameters whose name contains password, secret, token, api key, private key, card number, security code or is one of key, pin, salt, cvv, cvc, otp, iban, signature, auth, hash; the complete payment processor and carrier settings; any value that looks like a payment card number. Password-type settings and the password, salt and API key of users show only Changed (value hidden).

Request filters

Setting	Default	Description
Only log these dispatches	empty (all)	One per line: controller.mode, controller.* or *.mode.
Never log these dispatches	notification center, pickers, debugger, the log itself, menu switch, sign-in pages	Same format.

The filters apply to plain form submissions only. A change to a tracked object (for example a price) is always logged, also when its dispatch is excluded, so the filters cannot hide a change.

Retention and integrity

Setting	Default	Description
Keep entries for (days)	365	0 keeps everything. Older entries are deleted once a day.
Tamper-evident hash chain	On	Each entry is signed together with the previous one with a key derived from your store’s secret key. Verify integrity on the log page finds entries changed or deleted in the database.
Cron job		Shows the command and URL for the daily purge.

Without cron, the purge runs on the first administrator sign-in or log page view of the day. For a fixed time, add the command to cron, for example every night at 03:15:

15 3 * * * php /path/to/store/admin.php --dispatch=kv_admin_activity_log.cron

Or request admin.php?dispatch=kv_admin_activity_log.cron&cron_password=<your cron password> (the password from Settings → Security settings). Every purge is itself logged.

Alerts

Setting	Default	Description
Send alerts to	empty	E-mail addresses, one per line. Empty: no alerts.
Send an alert when	add-ons, administrator accounts, payment methods, price changes, purges	An add-on is installed, uninstalled, enabled or disabled; an administrator or vendor administrator is created or changed (account type, root flag, user groups, e-mail, password, API key) or user group privileges change; settings change; a payment method changes; a product price changes by more than the threshold; a sign-in fails; an administrator acts on behalf of a user; log entries are purged.
Price change threshold (%)	50	A price change of at least this percentage in either direction sends an alert. 0 turns the price alert off.

One request sends at most one e-mail with all its reasons, and at most 20 alert e-mails are sent per hour. The e-mail template is Activity log: alert (to administrator) in Design → E-mail templates.

License

The license status is shown in a License card at the top of the add-on page, above the tabs, so you see it on every tab. The License tab holds the key itself. The key is stored once for the whole installation.

The License card shows:

• the status in color: green when valid, blue for a development host or the 14-day period before a key is required (with the days left), amber when the license server could not be reached (with the days left) or a Marketplace number is still being verified, red when the add-on is switched off;
• in plain words what the status means and, when the add-on is (or will be) switched off, what stops: no new activity is recorded and no alert e-mails are sent; the existing log stays readable, exportable and purgeable;
• the licensed domain, every storefront with its result (covered, development host, not covered), the end of the updates and support period, the last and the next check, and the key in use (masked);
• the actions Enter license key / Change license key (opens the License tab), Check now (verifies at once and stays on the page), Manage license (your licenses on cs-cart.kaviolabs.com) and, without a valid license, Buy a license.

In Add-ons → Manage add-ons the add-on’s row shows a small license badge next to its name, for example License: Valid or License: Pending · 9 days left. The Activity log pages show the license status in a bar at the top.

Setting	Description
License key	Your Kavio Labs license key (KAVIO-XXXX-XXXX-XXXX-XXXX, from My licenses on cs-cart.kaviolabs.com) or your CS-Cart Marketplace license number. If you entered the Marketplace license number in Add-ons → Manage add-ons (the add-on’s license field), leave this empty: the add-on uses that number.
License status	Points to the License card and explains what the check sends.

What the license covers. A license is bound to the base domain you entered at purchase (for example yourstore.com) and covers every subdomain of it (www.yourstore.com, shop.yourstore.com, staging.yourstore.com). Local development hosts are always allowed: localhost, 127.0.0.1 and other private IP addresses, and host names ending in .localhost, .test, .local, .example or .invalid. A store on a different base domain needs its own license. If you move your store to a new domain, contact support.

When the add-on checks. When you save the key, and then once a day. The check runs only in the admin panel (on a page you open) or from cron, never while visitors browse the storefront, and takes a few seconds at most. A cron job keeps the license verified even when nobody opens the admin panel:

php /path/to/store/admin.php --dispatch=kv_admin_activity_log_license.check

What is sent. The check sends this to https://cs-cart.kaviolabs.com and nothing else: the license key, the add-on ID and version, the host names of your storefronts, your CS-Cart version and edition, and a random one-time value. No log entries, users or other personal data are sent. The server answers with a digitally signed result, so a forged answer is ignored.

Statuses.

Status (card)	Color	What happens
Valid	Green	The license is valid for this domain. Everything works.
Development host	Blue	The store runs on a local development host, which every license covers. Everything works.
Pending verification	Amber	A CS-Cart Marketplace license number was accepted, but the Marketplace has not confirmed it yet. Everything works.
Pending · N days left	Blue	No verified key yet (a new installation). Everything works for 14 days.
Grace period · N days left	Amber	The last checks failed (for example a network problem). The add-on keeps working for 14 days after the first failed check.
Not activated, Invalid key, Revoked, Domain mismatch, Not verified	Red	No new activity is recorded and no alert e-mails are sent. The log, the entry pages, the History tabs, the CSV export, the purge and the integrity check keep working. Domain mismatch shows the licensed domain next to the domain your store runs on.

When your updates and support period ends, the add-on keeps working. Only updates and support stop.

License information appears in the admin panel only, and only for administrators who may manage add-ons; vendors never see it.