Proxy access logs: what to record for an audit
An application audit log should reconstruct who did what, when, to which object, and with what outcome. Raw secrets are not needed.
Key points in one minute
- Every event needs a stable correlation ID.
- Viewing and exporting logs should themselves be audited.
- Versioned audit fields should not be replaced by free text.
- A log correction should be a new linked event.
Minimum event fields
Record normalized time, actor, action, object, outcome, request source, correlation ID, and command version.
Use a versioned event schema containing event ID, UTC timestamp, actor type and ID, tenant ID, action, resource type and ID, outcome, reason code, request or correlation ID, and interface source. Include IP and user agent only for a defined purpose and access tier. Keep administrator free text separate from system fields so search and export remain deterministic.
What to exclude
Do not store passwords, Proxy-Authorization, cookies, API tokens, or active rotation links. Mask sensitive values before logging.
Create a centralized redaction filter and tests with canary values for passwords, Authorization, cookies, API keys, payment details, and signed links. Masking after storage is insufficient because the secret may already reach backups or external systems. Keep sensitive values out of exception messages and use an error code plus safe object identifier instead.
Integrity
Restrict modification and deletion, synchronize time, and separate audit records from debug logs. Add a checksum to exports.
Store audit data in an append-only stream with restricted service-account permissions. Periodically checksum exports and verify event-ID or chain continuity while synchronizing clocks across nodes. Administrators must not edit original events; corrections become new linked events. Audit-store unavailability should trigger an explicit safe mode and alert.
Retention
Retention follows purpose, law, and contract. When the purpose ends, delete or anonymize data under an approved procedure.
Create a retention matrix for security, contract, payment, support, and technical-diagnostic records. For each category define purpose, basis, period, owner, and deletion or anonymization method, including backups. Have responsible specialists verify exact periods against current law and contracts. Apply legal holds separately and release them through a documented decision rather than indefinitely.
Practical checklist
- 1Define mandatory event fields.
- 2Mask before writing.
- 3Test timeline reconstruction.
- 4Test redaction with canary secrets.
- 5Verify data deletion from backups.
Sources and documentation
This material is based on primary, official, and technical sources. The article is an original summary written for this knowledge base.
This material is for general information only. Requirements should be checked against the current law and, when needed, with a qualified specialist. It is not individual legal advice.