diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py
index d2c97a7..61f068e 100644
--- a/Allura/allura/controllers/auth.py
+++ b/Allura/allura/controllers/auth.py
@@ -166,7 +166,7 @@
         user = self._validate_hash(hash)
         user.set_password(pw)
         user.set_tool_data('AuthPasswordReset', hash='', hash_expiry='')
-        M.AuditLog.log_user('Password changed (through recovery process)', user=user)
+        h.auditlog_user('Password changed (through recovery process)', user=user)
         flash('Password changed')
         redirect('/auth/')
 
@@ -205,7 +205,7 @@
                 message_id=h.gen_message_id(),
                 text=text)
 
-        M.AuditLog.log_user('Password recovery link sent to: %s', email, user=user_record)
+        h.auditlog_user('Password recovery link sent to: %s', email, user=user_record)
         flash('A password reset email has been sent, if the given email address is on record in our system.')
         redirect('/')
 
@@ -256,7 +256,7 @@
             })
 
             flash('Email address confirmed')
-            M.AuditLog.log_user('Email address verified: %s', addr._id)
+            h.auditlog_user('Email address verified: %s', addr._id)
         else:
             flash('Unknown verification link', 'error')
         redirect('/auth/preferences/')
@@ -387,7 +387,7 @@
         flash('Password changed')
         del session['pwd-expired']
         session.save()
-        M.AuditLog.log_user('Password reset (via expiration process)')
+        h.auditlog_user('Password reset (via expiration process)')
         if return_to and return_to != request.url:
             redirect(return_to)
         else:
@@ -435,7 +435,7 @@
             old = c.user.get_pref('display_name')
             c.user.set_pref('display_name', preferences['display_name'])
             if old != preferences['display_name']:
-                M.AuditLog.log_user('Display Name changed %s => %s', old, preferences['display_name'])
+                h.auditlog_user('Display Name changed %s => %s', old, preferences['display_name'])
             for i, (old_a, data) in enumerate(zip(c.user.email_addresses, addr or [])):
                 obj = c.user.address_object(old_a)
                 if data.get('delete') or not obj:
@@ -451,7 +451,7 @@
                             # clear it now, a new one will get set below
                             c.user.set_pref('email_address', None)
                             primary_addr = None
-                    M.AuditLog.log_user('Email address deleted: %s', c.user.email_addresses[i])
+                    h.auditlog_user('Email address deleted: %s', c.user.email_addresses[i])
                     del c.user.email_addresses[i]
                     if obj:
                         obj.delete()
@@ -467,7 +467,7 @@
                     em = M.EmailAddress.create(new_addr['addr'])
                     em.claimed_by_user_id = c.user._id
                     em.send_verification_link()
-                    M.AuditLog.log_user('New email address: %s', new_addr['addr'])
+                    h.auditlog_user('New email address: %s', new_addr['addr'])
                     flash('A verification email has been sent.  Please check your email and click to confirm.')
                 else:
                     flash('Email address %s is invalid' % new_addr['addr'], 'error')
@@ -478,7 +478,7 @@
                     if not kw.get('password') or not provider.validate_password(c.user, kw.get('password')):
                         flash('You must provide your current password to change primary address', 'error')
                         redirect('.')
-                    M.AuditLog.log_user(
+                    h.auditlog_user(
                         'Primary email changed: %s => %s',
                         c.user.get_pref('email_address'),
                         primary_addr)
@@ -501,7 +501,7 @@
             flash('Incorrect password', 'error')
             redirect('.')
         flash('Password changed')
-        M.AuditLog.log_user('Password changed')
+        h.auditlog_user('Password changed')
         redirect('.')
 
     @expose()
diff --git a/Allura/allura/lib/helpers.py b/Allura/allura/lib/helpers.py
index 5d978fa..dbed410 100644
--- a/Allura/allura/lib/helpers.py
+++ b/Allura/allura/lib/helpers.py
@@ -1190,3 +1190,17 @@
         fromfile='old',
         tofile='new',
         lineterm=''))
+
+
+def auditlog_user(message, *args, **kwargs):
+    """
+    Create an audit log entry for a user, including the IP address
+
+    :param str message:
+    :param user: a :class:`allura.model.auth.User`
+    """
+    from allura import model as M
+    ip_address = request.headers.get('X-Remote-Addr', request.remote_addr)
+    message = 'IP Address: {}\n'.format(ip_address) + message
+    M.AuditLog.log_user(message, *args, **kwargs)
+
diff --git a/Allura/allura/lib/plugin.py b/Allura/allura/lib/plugin.py
index 7f34559..14a2328 100644
--- a/Allura/allura/lib/plugin.py
+++ b/Allura/allura/lib/plugin.py
@@ -142,7 +142,7 @@
             if self.is_password_expired(user):
                 self.session['pwd-expired'] = True
                 from allura.model import AuditLog
-                AuditLog.log_user('Password expired', user=user)
+                h.auditlog_user('Password expired', user=user)
             if 'rememberme' in self.request.params:
                 remember_for = int(config.get('auth.remember_for', 365))
                 self.session['login_expires'] = datetime.utcnow() + timedelta(remember_for)
@@ -306,7 +306,7 @@
         user.disabled = True
         session(user).flush(user)
         from allura.model import AuditLog
-        AuditLog.log_user('Account disabled', user=user)
+        h.auditlog_user('Account disabled', user=user)
 
     def validate_password(self, user, password):
         return self._validate_password(user, password)
diff --git a/Allura/allura/tests/decorators.py b/Allura/allura/tests/decorators.py
index 3796de7..df0f0b9 100644
--- a/Allura/allura/tests/decorators.py
+++ b/Allura/allura/tests/decorators.py
@@ -154,18 +154,40 @@
 
 
 @contextlib.contextmanager
-def audits(*messages):
+def audits(*messages, **kwargs):
+    """
+    Asserts all the messages exist in audit log
+
+    :param messages: regex strings
+    :param bool user: if this is a user log
+
+    """
     M.AuditLog.query.remove()
     yield
+    if kwargs.get('user'):
+        preamble = 'IP Address: .*\n'
+    else:
+        preamble = ''
     for message in messages:
         assert M.AuditLog.query.find(dict(
-            message=re.compile(message))).count(), 'Could not find "%s"' % message
+            message=re.compile(preamble + message))).count(), 'Could not find "%s"' % message
 
 
 @contextlib.contextmanager
-def out_audits(*messages):
+def out_audits(*messages, **kwargs):
+    """
+    Asserts none the messages exist in audit log.  "without audits"
+
+    :param messages: list of regex strings
+    :param bool user: if this is a user log
+
+    """
     M.AuditLog.query.remove()
     yield
+    if kwargs.get('user'):
+        preamble = 'IP Address: .*\n'
+    else:
+        preamble = ''
     for message in messages:
         assert not M.AuditLog.query.find(dict(
-            message=re.compile(message))).count(), 'Found unexpected: "%s"' % message
+            message=re.compile(preamble + message))).count(), 'Found unexpected: "%s"' % message
diff --git a/Allura/allura/tests/functional/test_auth.py b/Allura/allura/tests/functional/test_auth.py
index 77367ec..9ab122f 100644
--- a/Allura/allura/tests/functional/test_auth.py
+++ b/Allura/allura/tests/functional/test_auth.py
@@ -181,7 +181,7 @@
                      'test-admin@users.localhost')
 
         # add test@example
-        with td.audits('New email address: test@example.com'):
+        with td.audits('New email address: test@example.com', user=True):
             r = self.app.post('/auth/preferences/update', params={
                 'preferences.display_name': 'Test Admin',
                 'new_addr.addr': 'test@example.com',
@@ -196,7 +196,7 @@
         assert_equal(user.get_pref('email_address'), 'test-admin@users.localhost')
 
         # remove test-admin@users.localhost
-        with td.audits('Email address deleted: test-admin@users.localhost'):
+        with td.audits('Email address deleted: test-admin@users.localhost', user=True):
             r = self.app.post('/auth/preferences/update', params={
                 'preferences.display_name': 'Test Admin',
                 'addr-1.ord': '1',
@@ -213,7 +213,7 @@
         user = M.User.query.get(username='test-admin')
         assert_equal(user.get_pref('email_address'), None)
 
-        with td.audits('Display Name changed Test Admin => Admin'):
+        with td.audits('Display Name changed Test Admin => Admin', user=True):
             r = self.app.post('/auth/preferences/update', params={
                 'preferences.display_name': 'Admin',
                 'new_addr.addr': ''},
@@ -872,7 +872,7 @@
         email.confirmed = True
         ThreadLocalORMSession.flush_all()
         old_pw_hash = user.password
-        with td.audits('Password recovery link sent to: test-admin@users.localhost'):
+        with td.audits('Password recovery link sent to: test-admin@users.localhost', user=True):
             r = self.app.post('/auth/password_recovery_hash', {'email': email.email})
         hash = user.get_tool_data('AuthPasswordReset', 'hash')
         hash_expiry = user.get_tool_data('AuthPasswordReset', 'hash_expiry')
@@ -885,7 +885,7 @@
         assert_in('New Password (again):', r)
         form = r.forms[0]
         form['pw'] = form['pw2'] = new_password = '154321'
-        with td.audits('Password changed \(through recovery process\)'):
+        with td.audits('Password changed \(through recovery process\)', user=True):
             # escape parentheses, so they would not be treated as regex group
             r = form.submit()
         user = M.User.query.get(username='test-admin')
diff --git a/Allura/allura/tests/functional/test_site_admin.py b/Allura/allura/tests/functional/test_site_admin.py
index ab1ffc4..b7ae16a 100644
--- a/Allura/allura/tests/functional/test_site_admin.py
+++ b/Allura/allura/tests/functional/test_site_admin.py
@@ -170,8 +170,8 @@
     def test_users(self, request):
         request.url = 'http://host.domain/path/'
         c.user = M.User.by_username('test-user-1')
-        M.AuditLog.log_user('test activity user 1')
-        M.AuditLog.log_user('test activity user 2', user=M.User.by_username('test-user-2'))
+        h.auditlog_user('test activity user 1')
+        h.auditlog_user('test activity user 2', user=M.User.by_username('test-user-2'))
         r = self.app.get('/nf/admin/users')
         assert_not_in('test activity', r)
         r = self.app.get('/nf/admin/users?username=admin1')