Laravel Auditing

Laravel Auditing captures a full change history for Eloquent models — who changed what, when, and the before/after values — by adding a single trait to a model. It listens to Eloquent’s create/update/delete lifecycle events, snapshots the old and new attribute state on each change, and persists each change as an Audit record, resolving the acting user, IP address, user agent, and URL automatically from the current request context.

With over 3,400 GitHub stars and 1.3M+ monthly composer installs, it is the de facto standard model-auditing package in the Laravel ecosystem, commonly reached for whenever an application needs compliance-grade change tracking, admin “who changed this” views, or anomaly/suspicious-activity detection on sensitive records.

What You Get

• An Auditable trait that adds full change-history tracking to any Eloquent model with minimal configuration
• Automatic capture of before/after attribute values, the acting user, IP address, user agent, and request URL for every change
• Pluggable Resolver classes for user, IP, URL, and user-agent resolution, replaceable to fit custom auth or request setups
• A swappable audit storage Driver interface, shipping a database driver with an included migration
• Redactor classes for masking sensitive attribute values (e.g. passwords) before they’re persisted in the audit trail

Common Use Cases

• Building a compliance or admin “activity log” view showing exactly what changed on a record and who changed it
• Detecting suspicious or anomalous data changes on sensitive models (permissions, financial records, user accounts)
• Supporting regulatory requirements (SOC 2, HIPAA-adjacent, financial audit trails) that mandate change-tracking on critical data
• Debugging production data issues by reviewing the exact sequence of attribute changes leading up to a bug report

Under The Hood

Architecture — The Auditable trait (860 lines) hooks into Eloquent’s model boot lifecycle to register created/updated/deleted event listeners via AuditableObserver, which builds an Audit model instance (322 lines) capturing old_values/new_values JSON diffs plus resolved metadata; Auditor.php orchestrates resolution by calling each configured Resolver (UserResolver, IpAddressResolver, UrlResolver, UserAgentResolver) before handing the assembled Audit record to a Driver implementation (Database.php by default) for persistence. Redactor classes intercept specific attributes before they’re written, allowing sensitive fields to be masked in the stored audit trail. Tech Stack — PHP 8.2+, Laravel/Lumen 11–13 (with documented compatibility back through Laravel 5.1 across major package versions), a published database migration for the audits table, and a config/audit.php file controlling which events, attributes, and thresholds are audited per model. Code Quality — A substantial PHPUnit test suite spanning Unit, Functional, Casts, and Models test directories, phpstan static analysis, Laravel Pint style enforcement, Scrutinizer CI for build/quality/coverage tracking, and 93 contributors across a decade of active maintenance, reflecting a mature, well-exercised codebase. API Design — Enabling auditing on a model requires only use Auditable plus implementing the AuditableContract interface, after which change tracking is fully automatic; opt-out and fine-tuning (excluded attributes, audit thresholds, custom resolvers) are all configuration-driven rather than requiring code changes, keeping the common case nearly zero-effort while still supporting deep customization for advanced needs.