Every login and logout event is captured with device type, operating system, browser, session ID, and IP-based geolocation — automatically, with no manual configuration after setup.
Why it matters: administrators always know who accessed the system, from what device, and from where, without relying on server logs or third-party tools.
All CRUD actions — record creation, updates, and deletions — are logged with the model name, record name, user identity, and timestamp.
Why it matters: organizations can trace exactly what each user did and when, making incident investigation and data accountability straightforward.
When an unrecognized or new login is detected, the module automatically sends an email alert to the designated administrator.
Why it matters: suspicious access attempts are flagged in real time rather than discovered after the fact.
Administrators can remotely end any active user session directly from the audit dashboard — with no need to access server infrastructure.
Why it matters: if a user leaves the organization, a device is lost, or unusual activity is detected, access can be revoked instantly.
Session time limits (default 8 hours) and idle timeout settings (default 60 minutes) can be adjusted to match organizational security policies.
Why it matters: sessions that would otherwise remain open indefinitely are automatically terminated, reducing unauthorized access risk.
A centralized audit dashboard displays login locations as pins on a world map alongside session summaries and activity feeds.
Why it matters: geographic anomalies — such as simultaneous logins from two countries — are immediately visible.
All audit data can be exported to Excel or CSV directly from the dashboard for compliance reporting, security reviews, or archival.
Why it matters: teams can produce clean, structured audit reports without needing custom report builders.
Three access levels — Audit User (own data only), Audit Manager (all user data), and System Admin (full configuration) — control who can view what.
Why it matters: sensitive session and activity data is protected by the same access control framework organizations use across Odoo.
Administrators can define exactly how many days of log data to retain, with automated cleanup managed via built-in cron job scheduling.
Why it matters: teams can meet data retention policies without manual database maintenance.
