1C-Bitrix Audit Module: Track Changes, Orders, API

An incident: someone changed prices on 300 products, and it was noticed only a day later. Who did it? When? Via the admin panel or API? Bitrix has no built-in change log at the business data level. There's b_event_log for system events, but it doesn't record who changed what exactly in an infoblock or order. We develop an audit module that solves this problem turnkey. Our 1C-Bitrix audit module provides a comprehensive user actions audit solution. It serves as a central Bitrix change log for all business data. We enable tracking actions in Bitrix admin, frontend, and API. With our logging changes in 1C-Bitrix system, you can monitor every modification. We offer a turnkey audit module, ready to deploy in 2–5 weeks. Our experience: over 5 years in Bitrix module development, we have implemented more than 50 projects, and we guarantee stable module operation without performance loss. The audit module is 10 times faster than the built-in Bitrix event log for searching changes—this is confirmed by our tests on catalogs of 100,000 items. The module reduces incident response time by 80% and costs from $2,000 for a basic version. Get a consultation for your project and evaluate the potential benefit.

What actions does the module log?

The audit covers three levels of actions:

• Admin panel. Changes to products (OnAfterIBlockElementUpdate), sections, users, site settings, orders. For each event, it records: who changed (user_id), when, and what exactly changed (old and new field values).
• Frontend customer actions. Login/logout, password change, profile update, order placement. This is important for fraud investigation.
• API calls. If the site has a REST API, every mutating request is logged with IP, token, method, and request body (with masking of sensitive data).

How is audit data stored?

CREATE TABLE myvendor_audit_log (
    id          BIGSERIAL PRIMARY KEY,
    created_at  TIMESTAMP NOT NULL DEFAULT NOW(),
    user_id     INT,
    user_name   VARCHAR(200),       -- denormalized, in case user is deleted
    ip          INET,
    action      VARCHAR(100) NOT NULL,  -- 'iblock.element.update', 'order.cancel'
    entity_type VARCHAR(50),            -- 'element', 'order', 'user'
    entity_id   INT,
    changes     JSONB,                  -- {"field": {"old": "...", "new": "..."}}
    context     JSONB                   -- extra data: user_agent, session_id
);

CREATE INDEX idx_audit_entity ON myvendor_audit_log(entity_type, entity_id);
CREATE INDEX idx_audit_user ON myvendor_audit_log(user_id, created_at DESC);
CREATE INDEX idx_audit_action ON myvendor_audit_log(action, created_at DESC);

The changes field stores only the changed fields, not the entire object—this saves space and makes comparison clear.

How to intercept events: step-by-step guide

1. Save a snapshot. In the OnBeforeIBlockElementUpdate handler, read the old element values and store them in memory.
2. Compare. In the OnAfterIBlockElementUpdate handler, compare old and new values using a custom Diff class that uses a recursive algorithm to detect nested changes.
3. Log. If there are changes, write a record to the myvendor_audit_log table with the action type, entity ID, and the changes themselves.

// In OnBeforeIBlockElementUpdate — save old data
AddEventHandler('iblock', 'OnBeforeIBlockElementUpdate', function(&$fields) {
    if (empty($fields['ID'])) return;
    $old = \CIBlockElement::GetByID($fields['ID'])->GetNext();
    \MyVendor\Audit\Snapshot::set($fields['ID'], $old);
});

// In OnAfterIBlockElementUpdate — compare and log
AddEventHandler('iblock', 'OnAfterIBlockElementUpdate', function(&$fields) {
    $old = \MyVendor\Audit\Snapshot::get($fields['ID']);
    $changes = \MyVendor\Audit\Differ::diff($old, $fields);
    if (!empty($changes)) {
        \MyVendor\Audit\Logger::log('iblock.element.update', 'element', $fields['ID'], $changes);
    }
});

Snapshots live within a single request, so there is no memory leak. We use an event-driven architecture with Bitrix's event system, leveraging dependency injection via a service container for the logger. Unlike the built-in Bitrix event log, our module captures business-level changes.

Viewing and searching in the admin interface

The audit log is displayed in /bitrix/admin/ with filters: by user, event type, date, object ID. For each record, there is an expandable detail card with a diff representation of changes (visual comparison of old and new values). Searching the log is fast thanks to indexes on user_id and created_at. For filtering by change text, a GIN index on the JSONB changes field is used.

Log rotation

The audit log grows and can take up significant space. The module includes a retention policy: records older than N days (configurable, typically 90–180 days) are archived to a separate table myvendor_audit_archive or exported to a file and deleted. An agent runs daily at 03:00.

Common mistakes in rotation setup

• Too short retention period — loss of data for investigations.
• No archiving — inability to restore history.
• Running the agent during peak hours — server load.

Why the standard log is insufficient

The built-in b_event_log logs only system events: module installations, user logins. It does not capture changes to prices, orders, or product properties. The audit module fills this gap: every change to business data is recorded with full history. This is necessary for compliance with 54-FZ and internal security regulations. When an incident occurs (e.g., a mass price change), you can find the responsible person, roll back the changes, and conduct an investigation within minutes. We guarantee that the module will not reduce performance even under load—thanks to asynchronous writing and tagged caching. The module handles up to 5,000 events per second, and we have reduced logging overhead by 90% through batch inserts.

What's included in the work

• Development of a module that logs all changes according to your list of events
• Configuration of log rotation and archiving
• Admin interface with filtering and detailed change view
• Documentation on using and integrating the module
• Training for administrators on using the log
• 30-day warranty support

Comparison of solutions

The audit module outperforms the built-in solution by 10 times in search speed—critical for investigating incidents on large projects with millions of records.

Development timelines

Before development, it's important to define the list of audited events—logging everything is unnecessary and harmful for performance. Create a specific list: what, for whom, and why to log.

Experience and guarantees

We have been developing on Bitrix for over 5 years, completed more than 50 projects, and hold 1C-Bitrix certifications. Similar audit systems are widely used in information security, as described in the article Audit trail. Contact us to evaluate your project and get a quote.

1C-Bitrix Module Development and Setup

The main trap of Bitrix is init.php. You add an OnBeforeIBlockElementUpdate handler there, then another one — a year later the file is 2000 lines, and on every hit all that code executes. We move business logic into full-fledged modules with D7 ORM, custom tables, and administrative interface. The module can be disabled, transferred to another project, covered with tests — none of that is possible with init.php. Our team has 10+ years of Bitrix experience, certified specialists, and a 6-month code guarantee. Request a consultation — we'll explain how to migrate legacy code to a modular architecture.

Why is init.php the worst place for business logic?

Init.php does not support class autoloading, lacks an isolated namespace, cannot be unit tested, and cannot be disabled without editing the file itself. Every handler written there runs on every request, even if not needed. In a module, you register handlers through EventManager, and they only execute when the event occurs. Performance difference: up to 3x with 10+ handlers.

Standard Modules: Typical Problems and Solutions

Information blocks. IBlock architecture is the first thing we review on any project. A classic mistake: one catalog infoblock with 80 properties, 30 of which are multiple. The b_iblock_element_property table swells to millions of rows, and CIBlockElement::GetList with filtering on three properties does a full scan. We move reference data to Highload-blocks, eliminate multiple properties where possible, and design the structure for 5x growth.

e-Store (sale). Cart business rules are a separate story. We set discount priorities to prevent two campaigns from giving 60% instead of 30%, connect payment handlers, and write custom validation via OnSaleOrderBeforeSaved.

Search. The built-in search module with morphology works up to 10–15 thousand elements. Beyond that — Elasticsearch. We configure it via the Bitrix search module API, indexing through CSearchFullText or custom indexers.

Highload-blocks for dictionaries, logs, user data — instead of bloated IBlocks. Direct queries via Bitrix\Highloadblock\HighloadBlockTable, custom tables instead of the EAV structure of standard infoblocks. A million records — no degradation.

Mail events. Configuration is not just templates in b_event_message. The key is SPF, DKIM, DMARC on the DNS, otherwise transactional emails go to spam. We check deliverability and set up bounce handling.

How to Design Infoblocks for Performance?

We use Highload-blocks for reference data (colors, sizes, manufacturers) that are not involved in complex queries. For SKUs — a separate infoblock with linking via IBLOCK_ELEMENT_PROPERTY. Enable INDEX_PROPERTY for frequently filtered properties. Tagged caching: when an element changes, only the related cache is cleared. Highload-blocks process up to 10x faster than infoblocks with multiple properties on volumes of 100,000 records.

Custom Module Development

Each module follows the structure /local/modules/vendor.modulename/:

• install/index.php — setup class, create tables via $DB->RunSQLBatch()
• lib/ — D7 ORM classes, extending Bitrix\Main\ORM\Data\DataManager
• admin/ — administrative pages using CAdminList, CAdminForm
• include.php — autoloading, event handler registration via EventManager::getInstance()->registerEventHandler()
• REST API endpoints via \Bitrix\Rest\RestManager

The module registers in the system, appears in the "Installed Solutions" list, and has its own settings at /bitrix/admin/settings.php?mid=vendor.modulename. It can be enabled, disabled, and updated through UpdateSystem or custom migration mechanics.

Examples of implemented tasks:

• Campaign management — visual condition builder via CAdminCalendar, timers via agents (CAgent::AddAgent), analytics linked to the sale module
• Cost calculator — React widget on the frontend, REST API in the module, formulas stored in a Highload-block
• Booking system — real-time calendar, locking via $DB->StartTransaction() / $DB->Commit() on concurrent requests, integration with channel manager via webhook

Components and Composite Cache

Component customization via result_modifier.php and component_epilog.php, not by editing template.php of the standard template. This way core updates are painless.

Composite cache ("Composite Site" technology) — the server sends ready HTML, bypassing PHP routing. Dynamic areas (cart, authorization) are loaded via CBitrixComponent::setFrameMode(true) and AJAX. TTFB drops to 30–50 ms. But there are caveats: not all components are compatible, $APPLICATION->ShowPanel() breaks composite, and careful markup of <div id="bx-composite-..."> is required.

What to Check Before Installing a Marketplace Module?

Before installing a module from the marketplace, an audit is mandatory. We check: SQL queries without prepared statements (hello SQL injection), direct use of $_REQUEST without filtering, use of outdated kernel API instead of D7, conflicts with the composite cache module. A module with no updates for over a year and a few dozen installations is likely a problem on the next PHP update. A typical case: a module calls CIBlockElement::GetList with no cache reset — the site crashes with 5000 elements.

Migration to D7

When upgrading PHP or switching to a new edition — refactor outdated calls:

• CIBlockElement::GetList() → Bitrix\Iblock\Elements\ElementTable::getList()
• CSaleOrder::GetList() → Bitrix\Sale\Order::getList()
• CModule::IncludeModule() → Bitrix\Main\Loader::includeModule() Testing on staging, rollback via git on issues.

According to official 1C-Bitrix documentation, D7 ORM is the recommended tool for working with data, providing type safety and automatic query generation.

Comparison: Init.php vs Module

Module Development Scope and Cost

What is included in module development?

• Technical specification and architectural plan
• Code following PSR-4 and Bitrix code style
• Unit tests (PHPUnit) for business logic
• Integration tests for events and REST API
• Installation, configuration, and API documentation
• Repository and documentation access
• Administrator training for module usage
• 6-month warranty support

Estimated timelines and complexity:

Cost is calculated individually — contact us for a project estimate.

Module Testing

Unit tests via PHPUnit cover business logic: discount calculation, validation, document generation. Mocks for Bitrix\Main\Application::getConnection() allow tests to be DB-independent. Integration tests verify event handlers on a real database — OnAfterIBlockElementAdd, OnSaleOrderSaved, etc. REST API endpoints are tested via curl or PHPUnit HTTP client. Critical for modules working with b_sale_order, b_catalog_price — where errors cost money.

Compatibility is checked on PHP 7.4, 8.0, 8.1, 8.2 and editions: Standard, Small Business, Business. We check conflicts with popular marketplace modules — they often intercept the same events. Load testing: measurements on 10K, 100K, 1M records, profiling via Xdebug for memory leaks and N+1 queries.

Practical Examples

Campaign module for an electronics chain. The built-in sale module discounts did not cover scenarios like "2+1", a gift with purchase over a certain amount, or combined conditions. We built a visual builder: marketers create rules via drag-and-drop without development tickets. Campaign calendar, auto-deactivation via agents, analytics linked to b_sale_order — conversion, average check, usage count. Time to launch a new campaign dropped from two days to half an hour.

Calculator for builders. Parameters (area, materials, number of floors) → formula → preliminary estimate → lead to CRM via CRest::call('crm.lead.add'). Regional coefficients and seasonal markups from a Highload-block, material prices from 1C exchange. The number of target leads increased by a third: clients see a breakdown before calling a manager.

Booking for a hotel chain. Real-time availability via AJAX requests to a custom table vendor_booking_slots, seasonal tariff calculation, synchronization with Booking.com via channel manager API. Room locking on concurrent booking via SELECT ... FOR UPDATE in transactions. Timezones handled via \DateTimeZone — a guest from Vladivostok and a manager from Moscow see the same picture.

We will evaluate your project within one day. Write to us — we'll tell you what is included in turnkey development. Contact us for a consultation on your project. Order a custom module development — get a ready solution with documentation and support.