Purpose of login logs

Login logs help confirm who logged in to the system, when the login happened, which IP address was used, what device or browser was used, whether the login succeeded, and whether abnormal login behavior exists.

These records give institutions a clearer view of back-office account access.

Recorded information

A login log can contain login time, user name, User ID, Organization ID, login IP, login country or region, device type, browser information, operating system, login method, login result, failure reason, Session ID, and other security information.

The exact fields can vary according to system version and security configuration.

Login results

Login logs can record different authentication results, such as successful login, wrong password, account not found, disabled account, too many failed attempts, MFA failure, IP not in whitelist, expired Session, SSO validation failure, or other authentication failures.

Failure reasons help administrators quickly understand why a login attempt was rejected.

Login source

The system can record source information when a user logs in, such as IP Address = 203.0.113.10, Device = Desktop, Browser = Chrome, Operating System = Windows, and Location = Tokyo, Japan.

This information can help determine whether a login matches the user's normal access pattern.

Abnormal login investigation

If an institution discovers abnormal account activity, login logs can support investigation.

Examples include login outside normal working hours, login from an unfamiliar country or region, many failed attempts in a short period, frequent logins from multiple IP addresses, new-device login, abnormal administrator access, blocked IP attempts, and repeated MFA failures.

Administrators can review these records to determine whether the account has security risk.

Log query

Institutions can query login records by time range, user, User ID, Organization ID, IP address, country or region, login result, device type, browser, and login method.

For example, an administrator can query all login records for a specific administrator in the past 30 days, or list all failed login records in the past 24 hours.

Working with IP whitelist

If the institution enables IP whitelist rules, login logs can help confirm whether an access request came from an authorized network.

For example: user login -> system checks source IP -> IP is not in whitelist -> login is rejected -> a failed login record is generated.

Administrators can then review the corresponding source IP and failure reason in the log.

Working with multi-factor authentication

When multi-factor authentication is enabled, the login process can include multiple authentication steps.

For example: account and password verification -> MFA verification -> login success.

If MFA verification fails, the system can record the corresponding result in login logs. This helps institutions determine whether the user completed the full authentication flow and at which stage the failure occurred.

Difference from operation logs

Login logs mainly record who entered the system, including login time, login IP, login device, login result, and login method.

Operation logs mainly record what the user did after entering the system, including configuration changes, user creation, permission changes, product adjustments, API creation, data export, and other back-office actions.

Used together, login logs and operation logs can reconstruct a more complete administrator activity trail.

Example

For example, the system detects abnormal login activity for an administrator account.

The login log can show: User = Admin A, Login Time = 2026-08-28 03:22:15, Source IP = 203.0.113.55, Location = Singapore, Device = Unknown Device, Result = Failed, Failure Reason = MFA Verification Failed.

Administrators can use this record to confirm whether the access attempt was initiated by the user, whether account credentials should be changed, or whether account permissions should be temporarily disabled.

Security recommendations

Institutions should periodically review administrator login records, failed login records, uncommon-region logins, new-device logins, frequent failed login attempts, privileged-account activity, and access outside normal working hours.

For abnormal login behavior, institutions should investigate together with account permissions, operation logs, and security settings.

Notes

Login logs mainly record authentication and access behavior for Finger Manager back-office accounts.

Institutions can combine login logs with operation logs, IP whitelist, multi-factor authentication, roles and permissions, and security settings to build a more complete access-security management model.

Login logs support security audit and troubleshooting, but do not replace an institution's own internal information-security management policy.