{"head":{"title":"What Is an Audit Log? Definition for Software Teams","description":"An audit log records who did what, when and from where in a system. What to log, how it differs from app logs, an example and the usual mistakes to avoid.","canonical":"https://oceanlab.in/glossary/audit-log"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"audit log","path":"/glossary/audit-log"}],"slug":"audit-log","term":"Audit log","aka":["activity log","security log"],"category":"Identity and security","short":"A record of who did what in a system, when and from where, kept so actions can be traced later.","body":[["Each entry in an audit log names an actor (a user, an admin or a service), the action (viewed, created, changed, deleted, exported, logged in), the object it touched, the time and usually the IP address or device. Entries are added, never edited."],["It is different from an application log, which helps engineers debug. An audit log is written for security teams, auditors and customers who need to answer the question: who did this? A regulated version, with stricter rules on what is kept, is often called an ",{"href":"/glossary/audit-trail","text":"audit trail"},"."]],"why":["When data leaks, a setting changes or money moves, the audit log is how you find out what happened. Security reviews and audits such as ",{"href":"/glossary/soc-2-type-ii","text":"SOC 2"}," ask for it, and enterprise buyers often want to see their own users' activity in the product."],"example":["In a B2B HR tool, an admin changes a manager's permissions and exports salary data. The audit log shows both actions with the admin's name, the time and the IP address. When the customer asks who exported the file, support can answer in minutes."],"inBuild":["We write audit events from the server, in the same transaction as the change where possible, into an append-only table or store. Admins get a filterable audit page, and we decide early how long entries are kept and who may read them."],"mistakes":[["Logging only failures. Successful sensitive actions, such as exports and permission changes, matter most."],["Letting admins delete or edit entries, which makes the log worthless as evidence."],["Writing secrets, passwords or full card numbers into the log."]],"related":[{"href":"/glossary/audit-trail","label":"Audit trail","detail":"A secure, time-stamped history of who created, changed or deleted a record, kept so the record can be trusted later."},{"href":"/glossary/rbac","label":"RBAC (role-based access control)","detail":"An access model where permissions are attached to roles, and people get access by being given a role."},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II","detail":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time."},{"href":"/glossary/observability","label":"Observability","detail":"How well you can understand what a running system is doing, and why, from the data it gives off: logs, metrics and traces."},{"href":"/glossary/maker-checker","label":"Maker-checker (four-eyes principle)","detail":"A control where one person makes a change and a different person must approve it before it takes effect."}],"tools":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/compliance/soc-2","label":"SOC 2 guide","detail":"The controls behind a SOC 2 report."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[],"legal":false,"updatedAt":"2026-10-25"}