Using the Event Log

The Storefront event log is a timestamped record of everything that happens in your store — every domain change, customer action, order event, and system operation. It shows what happened, when it happened, who did it, and where the request came from. It is your primary tool for investigating unexpected changes, confirming automated events ran correctly, and supporting customers who report problems.

The event log, email notifications, and webhooks

These three features draw from the same underlying event data but serve different purposes.

The event log is the complete record. Every event that can trigger a notification or webhook also appears in the event log, with full detail: actor, timestamp, IP address, and a plain-language description of what happened. Notifications and webhooks deliver a subset of that data proactively; the event log holds all of it, searchable, for as long as you need it.

Use the event log when you need to understand what happened. Use email notifications when you want to know as it happens. Use webhooks when you want your systems to react automatically.

See Storefront Email Notifications and Storefront Webhook Notifications for setup instructions.

The three views

Events are recorded in three places in Storefront Manager, all drawing from the same underlying log.

The full event log

The global event log shows every event across your entire Storefront — all customers, all domains, all orders.

To access it: log in to Storefront Manager, click your account menu in the upper right, and select Event Log.

Use this view when you want to see everything happening across your store, or when you're not sure which customer or domain an issue relates to.

The customer event log

Shows all events associated with a specific customer — their account activity, the domains in their account, and any orders they've placed.

To access it: go to Customers, open a customer record, and select the Event Log tab.

Use this when a customer contacts you about something in their account and you want the full picture of their activity.

The domain event log

Shows all events for a specific domain — registration, renewals, DNS changes, nameserver updates, contact privacy changes, forwarding, and more.

To access it: open a domain record and select the Event Log tab.

Use this when the question is specifically about a domain's history.

What's in each event entry

Every event shows the same five fields:

The "By" field

The By field identifies the actor and is the fastest way to understand the cause of any event:

• Customer — the end customer took this action themselves while logged into your storefront
• Reseller — you took this action from Storefront Manager
• As Customer — you used the Log in as Customer feature and performed the action while acting as that customer
• System — Storefront performed this automatically (auto-renewal processing, domain expiry, email delivery, and similar)

When a customer says "I didn't do that," checking the By field tells you immediately whether they're right.

Filtering and searching

All three log views support the same filtering and search tools.

Filter by actor to narrow events to a specific actor type: Reseller, Customer, As Customer, or System. Use this when you want to see only what the customer has done, or only what the system has done to verify automated events ran correctly.

Search by event text or IP address — the search bar matches against both the event description and the IP address field. This lets you find all events related to a specific domain (search example.com), find all login events (search login), or find all activity from a specific IP address.

Sort by clicking any column heading. The default is Timestamp descending (most recent first).

Event categories and what they cover

Account — customer login activity, password resets, account unlocks, email verification, account status changes, currency preference changes

Billing — credit card updates, payment method additions or removals

Order — domain registrations, renewals (manual and auto), transfers, imports, refunds, order failures

Settings — DNS record changes, DNS template applications, nameserver updates and failures, domain forwarding changes, WHOIS contact updates, auto-renew toggles, domain lock toggles, contact privacy changes

Emails sent — a record of automated emails dispatched to the customer: order confirmations, expiry notices, domain import welcome emails, and other system-generated customer communications

Ownership — domain moves between customer accounts, showing both source and destination usernames

System — automated events such as domain revokes, deletions, and other registry-level operations initiated by Storefront itself

Troubleshooting

A customer says their domain's DNS records changed without their knowledge. 

Open the domain's event log and filter by Settings. Find the DNS change event — the By column tells you if it was the customer, you, or the system. If there's an unexpected IP address, note it. If it shows Customer, the change came from the customer's own login session.

I want to confirm an auto-renewal ran correctly. 

Open the domain event log and look for an Order event with "Domain auto-renewed." The By field shows System and there is no IP address. If the event isn't there, check the global event log filtered by System to see if the renewal ran at all.

A customer says they never received their domain import email. 

Open the customer event log and look for an Emails Sent event around the time of the import. If it appears, the email was dispatched — ask the customer to check their spam folder. If it doesn't appear, the import may have failed; look for a domain import order event with an error message.

I want to see everything my customer has done in the last month. 

Open the customer event log, filter by Customer, and sort by timestamp. This shows only actions the customer themselves took, without your activity or system events.

I suspect unauthorized access to a customer account. 

Open the customer event log and search for login. Check IP addresses on login events against what you'd expect for that customer. A successful login from an unfamiliar IP is a potential sign of compromise. If you see one, suspend the account and send a password reset email immediately.

Related articles

• Managing Customer Accounts and Domains
• Storefront Email Notifications 
• Storefront Webhook Notifications 

Questions? Contact OpenSRS Support.

Was this article helpful? If not please submit a request here