Audit log
Also called activity log, security log.
A record of who did what in a system, when and from where, kept so actions can be traced later.
Last updated
What it is.
Each entry in an audit log names an actor (a user, an admin or a service), the action (viewed, created, changed, deleted, exported, logged in), the object it touched, the time and usually the IP address or device. Entries are added, never edited.
It is different from an application log, which helps engineers debug. An audit log is written for security teams, auditors and customers who need to answer the question: who did this? A regulated version, with stricter rules on what is kept, is often called an audit trail.
Why it matters
When data leaks, a setting changes or money moves, the audit log is how you find out what happened. Security reviews and audits such as SOC 2 ask for it, and enterprise buyers often want to see their own users' activity in the product.
In a product build
We write audit events from the server, in the same transaction as the change where possible, into an append-only table or store. Admins get a filterable audit page, and we decide early how long entries are kept and who may read them.
Common mistakes.
- 01
Logging only failures. Successful sensitive actions, such as exports and permission changes, matter most.
- 02
Letting admins delete or edit entries, which makes the log worthless as evidence.
- 03
Writing secrets, passwords or full card numbers into the log.
Work it out with a tool.
Related terms.
- Audit trailA secure, time-stamped history of who created, changed or deleted a record, kept so the record can be trusted later.
- RBAC (role-based access control)An access model where permissions are attached to roles, and people get access by being given a role.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
- ObservabilityHow well you can understand what a running system is doing, and why, from the data it gives off: logs, metrics and traces.
- Maker-checker (four-eyes principle)A control where one person makes a change and a different person must approve it before it takes effect.
Guides and pages
Browse the full glossary or read answers to common questions.
