Audit log
An audit log makes important application events traceable. Actor, action, affected object and outcome need to be readable together.
Trace an operation later
An audit log records selected application events important for traceability. It should show who attempted or performed which action on which object, when, and with what outcome. This includes a suitable timestamp and an interaction reference connecting related events. A general error counter does not answer these questions.
In a fictional project portal, user-17 tries to change the role on project-8 from viewer to editor. The server rejects the attempt and records the result denied. Someone reading only the requested role change might assume it happened. The outcome shows that this attempt granted no new permission.
Protect the record’s evidential value
The team defines which events it needs and who may read, write or delete the records. Passwords, access tokens and complete confidential documents do not belong in this log as convenient extra information. Retention also requires a justified rule.
Calling a file an audit log does not make it complete or tamper-proof. Protection against unauthorised changes and deletion, tamper detection and monitoring for logging failures belong in the implementation. A lost or subsequently altered entry can steer an investigation in the wrong direction.
Sources
Related terms
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Key rotationKey rotation introduces new key material. Older data and backups need a plan for the key versions they still require for decryption.
- Service level objective (SLO)An SLO sets a target for a defined service-quality measure over a stated period.
- Service level indicator (SLI)An SLI is a clearly defined measure of an aspect of service quality that matters to users.
- MonitoringMonitoring continuously collects and evaluates selected system states and functions. What it tells you depends on what is actually observed.
Articles on this topic
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.