Audit Trail

Audit Trail

Centralized event capture for CRUD activity across projects.

Overview

The audit trail service provides:

  • Centralized logging of all CRUD operations
  • User action tracking
  • Data change history
  • Compliance and security audit logs
  • Event querying and analysis

Purpose

Audit logging tracks:

  • Who performed the action (user identity)
  • What was changed (resource type and ID)
  • When the action occurred (timestamp)
  • How the action was performed (API endpoint, method)
  • Why (context and reason if provided)
  • Result (success/failure, details)

Components

Event Capture

Events captured for:

  • User creation, updates, deletion
  • Project/device management
  • Sensor data ingestion
  • Configuration changes
  • Access permission changes
  • Authentication events
  • Authorization failures

Event Schema

{
  "id": "unique-event-id",
  "timestamp": "ISO-8601",
  "user_id": "keycloak-user-id",
  "username": "user@example.com",
  "action": "CREATE|UPDATE|DELETE|READ",
  "resource_type": "user|project|device|sensor",
  "resource_id": "resource-id",
  "resource_name": "display-name",
  "changes": {
    "field_name": {
      "old_value": "previous",
      "new_value": "current"
    }
  },
  "status": "success|failure",
  "error_message": null,
  "ip_address": "user-ip",
  "user_agent": "browser-info",
  "context": {
    "api_endpoint": "/api/users",
    "method": "POST"
  }
}

Storage

Database Options

  • PostgreSQL: Primary audit log storage
  • MySQL: Alternative storage (if configured)
  • Time-series DB: For high-volume event analysis

Retention Policy

  • Production: 90 days minimum
  • Development: 30 days
  • Sensitive operations: Indefinite (compliance requirement)

Access & Querying

Who Can Access

  • System administrators
  • Compliance officers
  • Security team
  • Service owners (filtered by resource)

Query Capabilities

  • Filter by date range
  • Filter by user
  • Filter by resource type
  • Filter by action type
  • Search by resource ID
  • Full-text search on changes

Integration Points

Backend Service

All CRUD operations logged:

POST /api/users         → audit: user created
PUT /api/users/:id      → audit: user updated
DELETE /api/users/:id   → audit: user deleted

Keycloak Integration

  • User login/logout events
  • User creation/modification
  • Role and permission changes
  • Session management events

Monitoring Stack

Audit events can be:

  • Shipped to Loki for log analysis
  • Metrics extracted for alerting
  • Visualized in Grafana dashboards

Security Considerations

  • Immutable event storage (no modification)
  • Authenticated access to audit data
  • Encryption at rest and in transit
  • Rate limiting on query endpoints
  • Regular backups of audit logs

Compliance

Supports:

  • GDPR compliance (user data tracking)
  • SOC 2 audit requirements
  • ISO 27001 information security
  • General compliance reporting

Operational Monitoring

Metrics

  • Events per second
  • Event processing latency
  • Storage usage
  • Query performance
  • Retention compliance

Alerts

  • Audit service down
  • Event processing lag
  • High error rates
  • Storage capacity warnings

Deployment

Audit trail service deployed as:

  • Containerized application
  • Dedicated database for audit logs
  • Monitoring integration
  • Log shipping to central logging

Configuration

Environment variables:

AUDIT_DB_HOST=mysql
AUDIT_DB_USER=audit
AUDIT_DB_PASSWORD=password
AUDIT_DB_NAME=audit_logs
AUDIT_RETENTION_DAYS=90
AUDIT_LOG_LEVEL=info

References

  • Event sourcing patterns
  • Audit logging best practices
  • GDPR compliance guidelines
  • Security audit standards
Monitoring Stack