3

My problem is as follows:

I have one Magento community site, hosted on a virtual machine. I have two environments: PROD and DEV.

1,400 + products have been deleted from my PROD store.

My question is - are there activity logs that provide information (i.e. IP address of computer) that have actioned events from the Administration login?

I appreciate that there are some modules available that provide this information, but only going forward, not retrospectively.

Any help would be very much appreciated.

Improve this question

3 Answers 3

Reset to default
3

In Magento 2 Opensource (Community) version, there is no default way to log admin user's activity.

Still there may be some clues:

  1. The table admin_user_session keeps the session information about all the admin users (if not truncated/deleted/modified manually).
  2. You can check server's access.log to know the requests sent to your web server using a browser.

It may not get back your precious data, but it may help you to find the culprit.

Once you recover/ignore your data, you can install a custom extension to track the activity.

Also, change server login access, Magento admin panel access, mySQL login details as soon as possible and never share it with anyone you don't trust.

Improve this answer
3
  • Thank you very much for your response. I have investigated the admin_user_access table. There is an entry in user_id column marked as NULL which immediately precedes the mass deletion (I think). There are only two other user_ID's: 1 & 2. Could this mean an account has been created and then deleted retrospectively?
    – Deadulus
    Oct 11, 2018 at 9:20
  • It may be possible.
    – Mohit Kumar Arora
    Oct 11, 2018 at 10:38
  • Thank you for your quick reply - this is what I suspected. I assume this would be difficult to verify?
    – Deadulus
    Oct 11, 2018 at 10:59
1

Admin action logs have always been a pain for us in M1 and now in M2. We are not sure why Magento 2 doesn't add this feature in the product itself.

Anyways we installed the following module on our website and it works great for logging all admin activities. It also gives us information about the old and new data which is very useful in case we want to revert the changes back to original -:

Magento 2 Admin Activity Action Log

Improve this answer
0

You can use this extension for Admin activity and for gettings the IPs that have deleted from your PROD store, it gives you information for new and old data in admin. Admin Activity Logger is developed to improve the security of your store and provide you clear visibility of all the actions performed in your admin. It protects your admin from malicious attacks and gives you full control over your Magento 2 backend.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.