Gorm I don't quite understand your use case.
This extension logs actions, and specifically anything that can be relevant to security, so most write actions, and a few read actions if they are critical.
If you want to track all IPs a user ever used to access the forum, this might be better handled as a dedicated extension. Handling IP change as events might create too many events for the extension to handle efficiently if a user is behind a load balancing or VPN system.
Can you describe what you are trying to do? Are you trying to guess the frequency of visits from the audit log? Flarum sessions are long lived, hence why you will not see multiple login events for users who use the remember me feature. If you're trying to find actions for a specific user, the actor: gambit should take care of that. actor: takes either a user ID or username, and if you have the Pro version you can just use the log browser from a user's profile.
I could add a partial IP search gambit if you need it to inspect an entire subnet of suspicious IPs that might have been used to create many users.
