Audit Log

An audit log is a timestamped, tamper-resistant record of “who did what, and when” in a system — a trail for accountability and for reconstructing events after the fact.

An audit log differs from a technical log: technical logs are for debugging the application, an audit log is for answering the governance question “who changed this setting” or “who deleted this data.” Its real value shows up when something goes wrong and responsibility or the sequence of a change must be proven, which is why tamper-resistance is its defining property — a log you can edit is no longer testimony. The common trap is logging everything undifferentiated: a log that records every click becomes so noisy the important event is lost in it. A good audit log keeps only sensitive actions — an access change, a configuration change, a data deletion — with the actor's identity and an exact time.