diff --git a/app/Http/Controllers/Admin/AdminController.php b/app/Http/Controllers/Admin/AdminController.php
index 8ca689a..57cb72b 100644
--- a/app/Http/Controllers/Admin/AdminController.php
+++ b/app/Http/Controllers/Admin/AdminController.php
@@ -13,6 +13,7 @@ use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\View\View;
+use Illuminate\Support\Facades\Log;
 
 class AdminController extends Controller
 {
@@ -74,6 +75,8 @@ class AdminController extends Controller
     {
         $this->adminService->createUser($request->validated());
 
+        Log::info('Admin created new user', ['admin_id' => auth()->id(), 'user_data' => $request->validated()]);
+
         return redirect()->route('admin.users.index')->with('success', __('messages.user_create_success'));
     }
 
@@ -101,6 +104,8 @@ class AdminController extends Controller
 
         $this->adminService->updateUser($user, $validatedData);
 
+        Log::info('Admin updated user', ['admin_id' => auth()->id(), 'target_msnv' => $msnv, 'updated_data' => $validatedData]);
+
         $currentUser = auth()->user();
         if ($currentUser && $user->id === $currentUser->id && isset($validatedData['status']) && $validatedData['status'] == config('constants.STATUS_INACTIVE')) {
             auth()->logout();
@@ -138,6 +143,8 @@ class AdminController extends Controller
 
         $this->adminService->deactivateUser($msnv);
 
+        Log::info('Admin deactivated user', ['admin_id' => auth()->id(), 'target_msnv' => $msnv]);
+
         $currentUser = auth()->user();
         if ($currentUser && $user->id === $currentUser->id) {
             auth()->logout();
@@ -157,6 +164,9 @@ class AdminController extends Controller
     {
         try {
             $this->adminService->updateAddCard($id, $request->validated());
+            
+            Log::info('Admin updated add card history', ['admin_id' => auth()->id(), 'history_id' => $id, 'updated_data' => $request->validated()]);
+
             if ($request->expectsJson()) {
                 return response()->json([
                     'success' => true,
@@ -182,6 +192,9 @@ class AdminController extends Controller
     {
         try {
             $this->adminService->destroyAddCard($id);
+
+            Log::info('Admin deleted add card history', ['admin_id' => auth()->id(), 'history_id' => $id]);
+
             if ($request->expectsJson()) {
                 return response()->json([
                     'success' => true,
diff --git a/app/Http/Controllers/AuthController.php b/app/Http/Controllers/AuthController.php
index caa1271..585dba6 100644
--- a/app/Http/Controllers/AuthController.php
+++ b/app/Http/Controllers/AuthController.php
@@ -5,6 +5,7 @@ namespace App\Http\Controllers;
 use App\Services\Auth\Contracts\AuthServiceInterface;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
 
 class AuthController extends Controller
 {
@@ -40,6 +41,7 @@ class AuthController extends Controller
 
         // Brute-force check (lock after 5 failed attempts)
         if (\Illuminate\Support\Facades\RateLimiter::tooManyAttempts($throttleKey, 5)) {
+            Log::warning('Brute-force login attempt blocked', ['email' => $email, 'ip' => $request->ip()]);
             return back()->withInput($request->only('mail'))->with('dialog_error_brute_force', 'Tài khoản của bạn tạm thời bị khóa do nhập sai mật khẩu quá 5 lần. Vui lòng thử lại sau 15 phút.');
         }
 
@@ -47,11 +49,13 @@ class AuthController extends Controller
 
         if (!$result['success']) {
             if ($result['error_key'] === 'permission') {
+                Log::warning('Login attempt by deactivated user', ['email' => $email, 'ip' => $request->ip()]);
                 return back()->withInput($request->only('mail'))->with('dialog_error_permission', $result['error_msg']);
             }
 
             // For invalid password / email (counts towards brute-force attempts)
             \Illuminate\Support\Facades\RateLimiter::hit($throttleKey, 900); // 15 minutes lockout
+            Log::warning('Failed login attempt', ['email' => $email, 'ip' => $request->ip()]);
             
             return back()->withInput($request->only('mail'))->withErrors([
                 'mail' => $result['error_msg'],
@@ -62,6 +66,8 @@ class AuthController extends Controller
         \Illuminate\Support\Facades\RateLimiter::clear($throttleKey);
 
         $user = $result['user'];
+        Log::info('User logged in successfully', ['user_id' => $user->id, 'email' => $user->mail, 'ip' => $request->ip()]);
+
         if ($user->role != config('constants.ROLE_ADMIN') && $user->first_login == config('constants.FIRST_LOGIN_TRUE')) {
             return redirect()->route('login')->with('dialog_first_login', true);
         }
@@ -71,7 +77,9 @@ class AuthController extends Controller
 
     public function logout(Request $request)
     {
+        $userId = Auth::id();
         $this->authService->logout($request);
+        Log::info('User logged out', ['user_id' => $userId, 'ip' => $request->ip()]);
         return redirect('/login');
     }
 
@@ -91,9 +99,11 @@ class AuthController extends Controller
         $result = $this->authService->forgotPassword($request->input('mail'));
 
         if (!$result['success']) {
+            Log::warning('Forgot password requested for non-existent/invalid email', ['email' => $request->input('mail'), 'ip' => $request->ip()]);
             return back()->withInput()->with('dialog_forgot_error', $result['error_msg']);
         }
 
+        Log::info('Forgot password requested successfully', ['email' => $request->input('mail'), 'ip' => $request->ip()]);
         return back()->with('dialog_forgot_success', $result['message']);
     }
 }
diff --git a/app/Http/Controllers/User/UserController.php b/app/Http/Controllers/User/UserController.php
index e7e1d27..c85f97e 100644
--- a/app/Http/Controllers/User/UserController.php
+++ b/app/Http/Controllers/User/UserController.php
@@ -119,6 +119,13 @@ class UserController extends Controller
                 (int) $request->input('amount'),
                 (int) $request->input('template_id', 1)
             );
+
+            \Illuminate\Support\Facades\Log::info('User sent thank cards', [
+                'sender_id' => Auth::id(), 
+                'receiver_msnv' => $request->input('receiver'), 
+                'amount' => $request->input('amount'),
+                'template_id' => $request->input('template_id', 1)
+            ]);
         } catch (ThankCardException $e) {
             return response()->json(['success' => false, 'message' => $e->getMessage()], 422);
         }
@@ -250,6 +257,8 @@ class UserController extends Controller
         $user = Auth::user();
         $this->userService->updatePassword($user, $request->input('password'));
 
+        \Illuminate\Support\Facades\Log::info('User updated password', ['user_id' => $user->id]);
+
         $route = $user->role == config('constants.ROLE_ADMIN') ? 'admin.dashboard' : 'user.dashboard';
         return redirect()->route($route)->with('success', __('messages.password_change_success'));
     }
@@ -275,6 +284,8 @@ class UserController extends Controller
             $request->file('avatar')
         );
 
+        \Illuminate\Support\Facades\Log::info('User updated profile', ['user_id' => $user->id]);
+
         return redirect()->route('user.edit')->with('success', 'Cập nhật hồ sơ thành công');
     }
 }