4

I read an article that said if you use production data in your test system that you should enable logging and audit trails.

What is the difference between log files and audit trails? Isn't it nearly the same?

  • Audit trails can give you much more information. Basically you can log EVERY syscall if you want. – Peter Jan 24 '18 at 14:11
5

Logs record every action as it happens:

[timestamp] User A did action Y
[timestamp] User B did action Z
[timestamp] User C did action Y
...

Audit trails go much further into the connections between the actions and what other things happened as a result.

[timestamp] User A did action Y
[timestamp] System received Y and did action Z to data store
[timestamp] Data store was updated with data and sent notification back to User A
...

Logs tell you what an actor (user or entity) did. This is enough if you want to monitor who did what when.

Audit Trails tell you what sequence of actions occurred in order for a certain state to be created. This is what you want if you need to confirm how and why the system or the data is in a certain state.

And, in some cases, people use the terms interchangeably ...

In a test environment with production data, it is not enough to know that the devs logged in, for instance, but it is important to be able to prove that production data didn't leave the approved area. Audit trails help you prove the state of the production data at all times.

1

An audit trail is a recording of all user actions. A more formal definition can be found on wikipedia. Its purpose is to prevent/detect malicious use.

A log is a recording of what happens on a system. For details, see this wikipedia page. One of its main purposes is to analyse system malfunctioning, but it can also be used to investigate malicious use and other things. There are often many log files involved when using an application, for example: application log, OS log, DBMS log, network log etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.