Audit Trail — Track Changes, User Activity Log & Field History

Name: Audit Trail — Track Changes, User Activity Log & Field History
Brand: ECOSIRE
SKU: audit-trail-track-changes-user-activity-log-field-history

Temel Özellikler

ORM-level hooks on `create`, `write`, and `unlink` so inserts, updates, and deletions are all captured — not just tracked-field edits

Field-level before/after value capture with JSON serialization, rendered human-readably in the log view (including many2one label resolution)

Per-model, per-field, and per-operation logging rules via a configurable `ecosire.audit.rule` model — no code change to adjust coverage

Immutable, tamper-evident `ecosire.audit.log`: write/unlink locked below a dedicated Audit Manager group through `ir.model.access.csv` + record rules

Source IP, session, and acting-user capture derived from the request context on every logged event

Filterable, grouped audit log view (list/form/search) with facets by user, model, record, date range, and operation type

Optional QWeb PDF audit statement for a single record or a date range, suitable for handing to auditors

Retention and archival `ir.cron` job that compresses and rolls old entries so the audit table never bloats production

Compliance presets for common frameworks (SOX-style change control, ISO 27001, GDPR access/erasure evidence) scoped to your obligations

XML-RPC/JSON-RPC-readable log so entries can be exported to a SIEM, GRC, or data-warehouse pipeline

Sensitive-field masking option so values like passwords or bank tokens are logged as changed without exposing the payload

Multi-company aware: `company_id` on each entry with record rules so each company sees only its own audit trail

Configurable exclusion list to suppress high-churn technical fields and keep the trail signal-rich

Login/logout and failed-authentication activity logging option, tied into `res.users` events for a complete user-activity picture

Siparişe özel, sizin için baştan sona

Kendiniz kurmanıza gerek yok — ECOSIRE tarafından geliştirilen, kurulan ve desteklenen çalışır bir uygulama.

Sipariş verirsiniz

Tek seferlik geliştirme fiyatıyla başlayın. Kapsamı başlangıçta sizinle birlikte belirleriz.

Geliştirir ve kurarız

ECOSIRE, Odoo ortamınızda geliştirir, yapılandırır ve kurar.

Yayına alma + destek

Yaklaşık 2–4 haftada yayına alırsınız; lansman sonrası bir destek süresi de dahildir.

Bu Ürün Hakkında

When an auditor, a regulator, or your own finance lead asks "who changed this price, this bank account, or this posted journal entry — and when?", most Odoo databases cannot answer with confidence. Odoo core stamps create_uid/write_uid and write_date on every record, and the chatter (mail.thread + mail.tracking.value) logs tracked-field changes on models where a developer has explicitly set tracking=True. But that native surface is shallow: it does not span every model, it does not capture old-versus-new values for untracked fields, it never records the source IP or session, deletions vanish without a trace, and there is no unified, exportable log you can hand to a SOX, ISO 27001, GDPR, or industry-specific audit. Teams that run Odoo hit this wall the moment internal controls, compliance, or a dispute demand a defensible record of activity.

This is a made-to-order module that ECOSIRE builds against your exact database and control requirements — it is not an existing apps.odoo.com download you install blindly. We build a configurable audit engine that hooks the ORM create, write, and unlink methods (through targeted models.Model method overrides and/or ir.actions.server automated actions) on the models and fields you choose, and writes an immutable ecosire.audit.log entry for each event. Every record captures the model and record id, the changed field, the old and new values (JSON-serialized, human-readable in the log view), the acting user, a UTC timestamp, and the source IP and session derived from the request context. A rule engine (ecosire.audit.rule) lets an administrator turn logging on per model, per field, or per operation without touching code, so you audit account.move line changes and res.partner bank details tightly while leaving noisy operational models alone.

Technically, the log is designed to be tamper-evident and read-only to end users: write/unlink on ecosire.audit.log is blocked for everyone below a dedicated "Audit Manager" group via ir.model.access.csv plus record rules, so even administrators leave a trace. We ship a filtered, grouped log view (list, form, and search facets by user, model, date, and operation) built in XML/OWL, an optional QWeb PDF "audit statement" for a given record or date range, and a retention/archival job (ir.cron) that rolls old entries to a compressed archive so the table never bloats your production database. Because the entire feature is exposed through standard models, your compliance team can also pull the log programmatically over the XML-RPC/JSON-RPC API into a SIEM or GRC platform. We build for Community or Enterprise on Odoo 17.0, 18.0, or 19.0, and account for Enterprise-only surfaces (studio-created fields, documents, sign) during scoping so nothing you rely on is left un-audited.

Delivery is build-to-order: we start with a scoping call to confirm which models, fields, and operations must be tracked, your retention and compliance targets, and any SIEM/export destination; we then build on a staging copy of your database, run UAT with your team, and deploy behind a rollback plan. Typical delivery is 2–4 weeks from confirmed scope. Pricing starts from $249 (indicative, single-company base scope covering a defined set of models and the standard log view); broader model/field coverage, multi-company consolidation, SIEM/GRC integration, and localization or regulatory-report depth increase the quoted scope. You receive a fixed quote after the scoping call — never a surprise.

Ne elde edeceksin

Installable, version-pinned module source code for your Odoo edition (17.0, 18.0, or 19.0)

Installation and configuration on your staging environment, including audit-rule setup for the agreed models and fields

Technical documentation: model/field reference, rule configuration, security-group design, and API export notes

End-user and administrator guide plus a live training session for your compliance/admin team

UAT on a staging copy of your database with a documented, tested rollback plan before production go-live

Post-go-live support window for defect fixes and configuration tuning (duration set in the quote)

Private git repository handover with tagged release and commit history

Deployment to production with health verification of logging, the log view, and the retention cron

Bu kimin için

Compliance & Internal Audit Lead

Owns SOX, ISO 27001, or GDPR evidence and needs a defensible, exportable record of who changed critical data and when. Requires immutable logs, retention control, and audit statements they can hand to external auditors without manual reconstruction.

Finance / Accounting Controller

Needs tight change control over `account.move`, journals, bank details, and pricing. Wants field-level before/after history and IP capture so any edit to financial records is traceable and disputes can be settled from the log rather than guesswork.

IT / Odoo Administrator

Manages the Odoo database and security model. Needs per-model logging rules, a trail that even admins cannot silently alter, retention that won't bloat production, and API access to push events into an existing SIEM or GRC tool.

Operations / Compliance Manager in a regulated industry

Runs Odoo in healthcare, finance, or manufacturing where regulators expect a full user-activity trail. Needs configurable coverage across custom and standard models, plus login/activity logging, to prove operational controls are enforced.

Audit Trail — Track Changes, User Activity Log & Field History Nasıl Karşılaştırılır

Kriter	ECOSIRE	Özel Yapı	Rakip
Coverage of changes	create/write/unlink on chosen models and fields, incl. deletions	Whatever you build and maintain in-house	Often tracked-fields only; deletions frequently missed
Field-level before/after values	Old and new values captured and rendered readably	Possible but you build the serialization yourself	Usually yes for supported fields; varies by app
IP / session capture	Source IP and session recorded on each event	Only if you code the request-context hook	Rarely included
Tamper-evidence	Log locked below an Audit Manager group; admins leave a trace	Depends entirely on your implementation	Often editable by any admin
Compliance export	QWeb audit statements + API export to SIEM/GRC	Build and maintain your own exporters	Basic export at best; SIEM integration uncommon
Fit to your controls	Scoped to your models, retention, and regulations	Fully bespoke but fully your burden	Generic; you adapt your process to the app
Retention / DB bloat	ir.cron archival keeps production lean	You design the archival strategy	Often none; audit table grows unbounded
Support & ownership	Support window + full git repo handover	Your team owns all maintenance	Vendor SLA varies; source often obfuscated

Audit Trail — Track Changes, User Activity Log & Field History hakkında Sıkça Sorulan Sorular

Is this an existing app I can download and install today?

No. This is a build-to-order module that ECOSIRE scopes, builds, installs, and supports against your specific Odoo database and compliance requirements. There is no instant download — we tailor the tracked models, retention, and export destinations to your controls before delivery.

How long does delivery take?

Typical delivery is 2–4 weeks from confirmed scope. The timeline starts once we've agreed on which models, fields, and operations to track, your retention and compliance targets, and any SIEM/export integration during the scoping call. Larger multi-company or integration-heavy builds extend the schedule, which we confirm in the quote.

How does pricing and scoping work?

Pricing starts from $249 as an indicative single-company base scope covering a defined set of models and the standard log view. Broader model/field coverage, multi-company consolidation, SIEM/GRC integration, and regulatory-report depth increase the quoted scope. After a short scoping call we give you a fixed quote — never a surprise fixed price before we understand your requirements.

What about support and updates after go-live?

Every build includes a post-go-live support window (duration set in your quote) for defect fixes and configuration tuning. You also receive the private git repository so your team or ours can maintain it. Upgrades to a newer Odoo major version, or added model coverage later, are handled as a scoped follow-on engagement.

Can users or even administrators tamper with the audit log?

No. The `ecosire.audit.log` model is read-only to end users and administrators alike: write and unlink are blocked below a dedicated Audit Manager group via `ir.model.access.csv` and record rules, so the trail is tamper-evident. We can also configure retention archival so historical entries are preserved off the live table.

Does it work on Odoo Community and Enterprise, and which versions?

Yes — we build for Odoo Community or Enterprise on versions 17.0, 18.0, and 19.0. During scoping we account for Enterprise-only surfaces such as Studio-created fields, Documents, and Sign so nothing you depend on is left un-audited. We pin the module to your exact edition and version.

Can the audit data feed our SIEM or compliance tooling?

Yes. Because the log is a standard Odoo model, entries are readable over the XML-RPC/JSON-RPC API and can be pushed into a SIEM, GRC platform, or data warehouse. We scope the export format and cadence with you and can build a scheduled push or a pull endpoint as part of the engagement.