# Session Logs

https://docs.wisecp.com/de/session-logs

See where and from what every client and staff sign-in came, so an unexpected country, address or device shows up before it becomes a problem.

## Opening the Screen

Open `{admin}/tools/actions/login-log` from the Tools menu. The chosen tab stays in the address, so `{admin}/tools/actions/login-log?type=admin` opens straight on staff sign-ins.

## What Is on the Screen

Two tabs carry the same table. **Client** lists sign-ins to the customer panel, **Administrator** lists sign-ins to the admin panel. Each tab has its own search box, its own filter panel and its own paging. The download button beside the search box exports the filtered list as CSV, JSON or XML.

- **By**: Whose session it was. On the Client tab the name opens that client record when you have access to it; otherwise it stays as plain text. Staff names always carry a link.
- **Date of Login**: When the sign-in happened. The list starts sorted on this column, newest first, and you can reverse it.
- **Platform**: The operating system read from the browser: Windows, macOS, Android, iOS, Linux.
- **Browser**: Browser name and version.
- **IP Address / Port**: The connecting address. The lookup button beside it finds the other records from the same address. This column is sortable.
- **Country**: The country the address resolves to. An address that resolves to no country leaves the cell empty.
- **City**: The city the address resolves to. A dash means the lookup returned nothing.

### Filter panel

The **Advanced Filter** button sits next to the search box and carries a counter for how many filters are active. It opens a panel with three filters. A choice narrows the tab you are looking at right away, but it is also written into the address, so a reload or a shared link opens both tabs narrowed.

- **Country**: A country list. **All** is the default and applies no country filter.
- **City**: Free text. It matches any city containing what you type, so a partial name is enough.
- **Date of Login**: A date range picked from the calendar. Pick one day to see that day only.

## Tasks

### Review a suspicious sign-in

1. Open the tab for the account type, then type the name, e-mail or address in the search box.
2. Compare the Country, City and Platform columns of the account's own rows against each other.
3. Use the lookup button on the address to see who else connected from there.

### Narrow by place and date

1. Click the **Advanced Filter** button on the tab you are looking at.
2. Pick a country, type part of a city name, or choose a date range. The list narrows as you go.
3. The address keeps your choices, so you can share the narrowed list as a link.

## Things to Watch

> **Closing the filter panel clears the filters**
> 
> Collapsing **Advanced Filter** empties all three fields and reloads the full list. Leave the panel open while you work through a set of results.

> **Records are removed on their own**
> 
> A daily maintenance task deletes sign-in records older than the retention period set on the Automation screen. This screen has no manual clearing, so a long history depends on that period.

> **Location is a lookup, not proof**
> 
> Country, city, platform and browser come from the address and the browser's own description of itself. A VPN, a mobile network or a corporate proxy moves the location. Read an unexpected country as a reason to check, not as evidence.

## Required Privileges

The screen needs `TOOLS_ACTIONS`. Both tabs open with it, including staff sign-ins. A client name in the By column becomes a link only with `USERS_LOOK`. The download button beside the search box follows the panel-wide `TABLE_EXPORT`; an account without that privilege never sees the button.

## Related Articles

- [Activity Logs](https://docs.wisecp.com/en/action-logs)
- [Client Activity Logs](https://docs.wisecp.com/en/client-activity-logs)
- [Error Logs](https://docs.wisecp.com/en/system-error-logs)