An audit log is a chronological system record of selected events, actions and changes used for security, operations and accountability. It should help a reviewer determine what happened, when it happened, which identity or system initiated it and what record was affected.
What should an audit log capture?
- Event type and precise timestamp
- User, service or integration identity
- Affected record and relevant before-and-after values
- Source, device or network context where appropriate
- Outcome, error and correlation identifiers
- Approval, override or administrative reason
Audit log vs. application log
An application log helps operate and troubleshoot software. An audit log is designed to establish accountable business or security events. The records can overlap, but debug output alone may lack the identity, integrity or retention needed for audit evidence.
How should logs be protected?
Restrict access, synchronize time, prevent unauthorized alteration and retain logs according to legal and operational requirements. Sensitive values should be minimized or masked without removing the context needed to investigate an event.
What does a log not prove?
A log entry proves only what the logging system reliably recorded. It may not prove that an external bank settled a payment, a recipient received funds or a user understood an action. Reconcile system events with authoritative external evidence where required.
