An audit log should answer who did what, to which tenant-owned object, when, from where, and whether it succeeded. It supports customer administrators, internal support, incident response, and compliance—but it should not become a copy of every application payload.
Last updated: September 8, 2026.
CREATE TABLE audit_events (
event_id BIGINT PRIMARY KEY AUTO_INCREMENT,
tenant_id BIGINT NOT NULL,
actor_id BIGINT NULL,
action VARCHAR(100) NOT NULL,
object_type VARCHAR(60) NOT NULL,
object_id VARCHAR(100) NULL,
outcome VARCHAR(20) NOT NULL,
source_ip VARBINARY(16) NULL,
occurred_at TIMESTAMP(6) NOT NULL,
details JSON NULL,
INDEX (tenant_id, occurred_at)
);Use stable action names such as user.invited, role.changed, export.created, and subscription.updated. Include a request or correlation ID so related application logs can be found.
Record meaningful changes
For configuration changes, store a safe summary of changed fields or approved before-and-after values. Never log passwords, session tokens, API secrets, payment details, or complete sensitive records. Sanitize user-controlled text to prevent log injection.
Include automated actors as well as people. A subscription webhook, scheduled process, support operator, and API key should each have a distinguishable actor type.
Protect the log
Prefer append-only writes and restrict update or delete permissions. Send copies to centralized storage with retention controls when audit requirements are strong. Monitor gaps, write failures, clock problems, and unusual deletion attempts. Define retention by purpose rather than keeping everything forever.
Keep access tenant-aware
Customer administrators should see only events belonging to their tenant, using the same tenant isolation as business data. Provider support access requires its own authorization and should itself create an audit event. Large exports need limits and may run as background jobs.
OWASP’s logging guidance recommends recording when, where, who, and what while excluding data that should not be logged. It also notes that audit, transaction, and security logs can serve different purposes and may need separate treatment.
