Audit Log

An audit log is a record that a computer system writes itself about its own usage. Every important action is recorded in it as a single line. Such a line answers four questions: Who acted, when, what exactly, and with what result. An example: “User M. Weber downloaded the file Salaries.xlsx on 03/14 at 9:22 AM.” The log is not intended to be read by someone every day. It is written so that one can later look something up in it when questions arise. You can think of it like the logbook of a company car, except that it fills itself in automatically and no one can neatly rewrite it afterward.

What a log makes provable

Without a record, a suspicion cannot be verified. If customer data falls into the wrong hands, a company wants to know through which access this happened. This is exactly the reconstruction that the audit log provides. It distinguishes between an attack from outside, a bug in the program, and an employee who took data. Without this distinction, any investigation remains mere speculation.

For many applications, such a log is also legally required. Hospitals, banks, and government agencies must be able to prove who had access to sensitive files. Auditors regularly demand this evidence. If the log is missing, the proof is considered not to have been provided, even if nothing wrong actually happened.

With artificial intelligence, there is an additional reason. Modern AI systems act partly on their own: they write emails, book appointments, or modify databases. If something goes wrong in the process, it must be possible to look up which action the system carried out in response to which instruction. The audit log is often the only way to assign responsibility at all here.

How entries are created and protected

Programmers define in the software which processes are logged. Typical ones are logins, changes to settings, access to confidential data, and deletions. Each entry receives a timestamp, i.e., an exact time, and the identifier of the acting account. Often the IP address is also stored; this is the network address of the device used.

It is crucial that no one can alter entries after the fact. A log that the perpetrator is allowed to overwrite is worthless. That is why audit logs are often kept on a separate system to which normal users have no write access. Some systems work with checksums: from each entry, a kind of digital fingerprint is calculated, which belongs to the next entry. If you change a line, the fingerprints no longer match, and the manipulation is exposed.

A common misconception is that audit log and log are the same thing. An ordinary log is a technical diary for developers and contains error messages and intermediate values. It is often deleted after a few days. An audit log, on the other hand, documents the actions of people, is protected against changes, and is retained for years.

From the school portal to the cloud invoice

Anyone who has an online account is already a user of an audit log themselves. On Google, Instagram, or in a school platform, there is an overview of recent logins with device, location, and time. If an unfamiliar device shows up there, someone has probably obtained the password. That is exactly what this list is for.

In companies, the audit log is a standard selling point of software. Cloud service providers advertise that their more expensive business plans come with complete logs. Even with AI tools for businesses, this is now part of the offering: you can look up which employee sent which request to the model. For companies with trade secrets, this is often the reason to choose a paid plan in the first place.

In the news, the term usually comes up after a security incident. Then it is said that the analysis of the logs narrowed the access down to a certain period of time. Or, alternatively, that there were no adequate logs, which is why the extent of the damage remains unclear. This second variant is considered a serious accusation in the field.