What is an audit log?
An audit log is a chronological record of who did what in a system and when, kept so that it can be reviewed afterwards.
The log shows sign-ins, searches, changes and other events. Each entry records the time, who carried out the event and what happened.
A tamper-evident log is built so that later changes show. A common approach is to link each entry to the one before it, so that an altered or deleted entry breaks the chain.
The log is the basis for handling incidents, for audits and for answering questions about what happened. With AI it can also show which questions were asked and what an AI agent did.
How it works
The system writes log entries automatically when something happens. No user can opt out of an event being logged, and nobody can change an entry without it showing.
The log can be forwarded to the organisation's security monitoring. There it can be compared with events in other systems and raise an alert when something looks wrong.
Why it matters
Many regulations ask for traceability. The EU cybersecurity directive sets requirements for incident handling, and after a personal data breach it must be possible to see what happened. AI adds a new question, namely what an AI agent did and on whose behalf.
What to keep in mind
A log can itself contain sensitive information, such as questions that include personal data. It therefore needs the same protection and retention periods as other information. In Swedish public authorities, logs can also be official documents open to public access.
Make sure the log can be read by those who review it, with access control deciding who may see it.
What it means for you
Decide who reads the log, how often and how long it is kept. Then it is at hand on the day something needs to be investigated.
Common questions
How does an audit log differ from an ordinary log?
Many systems log events for troubleshooting. An audit log exists for review and is protected against changes after the fact.
How long should the log be kept?
That depends on the organisation's requirements and on what the log contains. Set a retention period and keep to it, so the log neither disappears too early nor is kept longer than necessary.
Sources: NIST on audit logDigg framework for logging and traceability (in Swedish)
Related terms
Read more
All terms Updated