When a client asks who changed something, or your own team suspects a shared password, these two logs are where you look.

Login Trails

Found under the General Reports menu. It lists interface logins for every user with:

• ID, sorted newest first
• Username, which is a link, plus a copy icon
• IP
• User Agent, including OS, browser and whatever else the agent reports
• Timestamp

You can search, change entries per page, reload, delete selected rows, and save the current page as CSV.

Two things to know. First, IP and user agent are not always accurate, so treat them as indicators rather than proof. Second, clicking the username impersonates that user. That is handy for support, but it means anyone with access to this page can walk into a client account, so keep the permission tight (see Admin Roles).

Attempts Logs

This one tracks login and OTP attempts, including from people who never got in. Columns are ID, IP, number of attempts, the feature the attempt was made against (new registration, login and so on), timestamp, and an action column.

The limits that govern these attempts come from General Settings on the OTP Login tab, where you set the maximum tries for login and OTP.

Same table controls: reload, delete selected, CSV export of the current page, search and pagination.

Using them together

• Client reports an unauthorised change: Login Trails for that username around the time, then compare IPs against the ones they normally use.
• Repeated support tickets about being locked out: Attempts Logs by IP tells you whether it is one confused user or a script.
• Signup abuse: filter Attempts Logs by the registration feature. A single IP with dozens of attempts is someone farming trial accounts.
• Before you ban anything: check both logs. An IP with a hundred attempts and no successful login is a very different story from one with a hundred attempts and five successes.

Retention

Both tables grow quickly on a busy platform. Export before you delete, keep the exports somewhere safe, and agree a retention period with whoever handles compliance at your company, especially if you sell to banks or insurers who will ask.

Related articles

• Security Monitoring: How Automatic IP Blocking Protects Your Platform
• How to Ban an IP Address Manually
• Admin Roles and Permissions
• Turning off login alerts notification