Using the Event Log

The Storefront event log is a timestamped record of everything that happens in your store — every domain change, customer action, order event, and system operation. It tells you what happened, when it happened, who did it, and where the request came from.

As the reseller, you can't always be present when your customers make changes. The event log is how you stay informed and how you investigate when something doesn't look right. It's also your first resource when a customer contacts you saying something changed unexpectedly — rather than guessing, you can look it up.

The three views

Events are recorded in three places in Storefront Manager, all drawing from the same underlying log. Which one you use depends on what you're investigating.

The full event log (all events in one place)

The global event log shows every event across your entire Storefront — all customers, all domains, all orders. This is the broadest view.

To access it: log in to Storefront Manager, click your account menu in the upper right, and select Event Log.

Use this view when you want to see everything happening across your store, or when you're not sure which customer or domain an issue relates to.

The customer event log

Shows all events associated with a specific customer — their account activity, the domains in their account, and any orders they've placed. Automatically filtered to that customer.

To access it: go to Customers, open a customer record, and select the Event Log tab.

Use this when a customer contacts you about something in their account and you want the full picture of their activity.

The domain event log

Shows all events for a specific domain — registration, renewals, DNS changes, nameserver updates, contact privacy, forwarding, and more. Automatically filtered to that domain.

To access it: open a domain record and select the Event Log tab.

Use this when the question is specifically about a domain's history.

The subscription event log

Shows all events for a specific subscription — purchase, renewals, suspensions, and reactivations. Automatically filtered to that subscription.

To access it: open a subscription from the Products page, and select the Event Log tab.

Use this when the question is specifically about a subscription's history. See Managing Customer Subscriptions in Storefront for more on the subscription details page.

What's in each event entry

Every event shows the same five fields:

The "By" field — the most useful column for troubleshooting

The "By" field identifies the actor and is the fastest way to understand the cause of any event:

• Customer — the end customer took this action themselves while logged into your storefront
• Reseller — you took this action from Storefront Manager
• As Customer — you used the "Log in as Customer" feature and performed the action while acting as that customer
• System — Storefront performed this automatically (e.g. auto-renewal processing, domain expiry, email delivery)

When a customer says "I didn't do that," checking the "By" field will often immediately tell you whether they're right.

Filtering and searching

All three log views support the same filtering and search tools.

Filter by actor

Use the filter to narrow events to a specific actor type: Reseller, Customer, As Customer, or System. This is useful when you want to see only what the customer has done (to understand their actions) or only what the system has done (to verify automated events like renewals ran correctly).

Search by event text or IP address

The search bar matches against both the event description and the IP address field. This lets you:

• Find all events related to a specific domain across all customers (search example.com)
• Find all login events (search login)
• Find all activity from a specific IP address — useful if you suspect unauthorized access or want to confirm a customer's device

Sorting

All columns are sortable. The default is Timestamp descending (most recent first), which is usually what you want when investigating a recent issue.

Event categories and what they cover

Events are organized into types. Here's what falls under each:

Account — customer login activity, password resets, account unlocks, email verification, account status changes, currency preference changes

Billing — credit card updates, payment method additions or removals

Order — domain registrations, renewals (manual and auto), transfers, imports, refunds, order failures, subscription purchases, subscription renewals, subscription suspensions and reactivations

Settings — DNS record changes, DNS template applications, nameserver updates and failures, domain forwarding changes, WHOIS contact updates, auto-renew toggles, domain lock toggles, contact privacy changes

Emails sent — a record of automated emails dispatched to the customer (order confirmations, expiry notices, domain import welcome emails, etc.)

Ownership — domain moves between customer accounts, showing both source and destination usernames

System — automated events like domain revokes, deletions, and other registry-level operations initiated by Storefront itself

Practical scenarios

A customer says their domain's DNS records changed without their knowledge

Open the domain's event log and filter by "Settings." Find the DNS change event — the "By" column will tell you if it was the customer, you, or system. If there's an unexpected IP address, note it. If it shows "Customer," the customer made the change from their own login session.

You want to confirm an auto-renewal ran correctly

Open the domain event log and look for an Order event with "Domain auto-renewed." The "By" field will show "System" and there will be no IP address. If you don't see it, check the global event log filtered by System to see if it ran at all.

You want to confirm a subscription's renewal charge went through

Open the subscription's event log (or the customer's event log, filtered by Order) and look for a "Subscription renewed" event. The "By" field will show "System" and there will be no IP address. If it's not there, check whether the subscription shows Payment Failed in Storefront Manager — the renewal may still be retrying.

A customer says they never received their domain import email

Open the customer event log and look for an Emails Sent event around the time of the import. If it's there, the email was dispatched — ask the customer to check spam. If it's not there, the import may have failed (check for a domain import event with an error message).

You want to see everything your customer has done in the last month

Open the customer event log, filter by "Customer," and sort by timestamp. This shows only actions the customer themselves took, making it easy to review their activity without your own or system events in the way.

You suspect unauthorized access to a customer account

Open the customer event log and search for "login." Check the IP addresses on login events against what you'd expect for that customer. If you see an unfamiliar IP with a successful login, treat it as a potential compromise.

Connection to notifications and webhooks

The event log and Storefront's notification system are built on the same underlying data. If you want to be notified of certain events proactively — rather than checking the log after the fact — you can configure:

• Email notifications — receive emails when specific event categories trigger
• Webhooks — receive real-time HTTP notifications to your own systems

See Storefront Notifications and Webhook Notifications for details on setting these up.

Related articles

• Managing Customer Accounts and Domains
• Storefront Email Notifications 
• Storefront Webhook Notifications 

Questions? Contact OpenSRS Support.