Audit logging

An audit record must answer who, what, when, where, on which object and with what outcome, which is almost literally the content requirement in NIST SP 800-53 control AU-3. The surrounding AU family sets the rest of the design: AU-2 (which events to log), AU-8 (time stamps), AU-9 (protection of audit information), AU-11 (retention) and AU-12 (audit record generation). ISO/IEC 27001:2022 covers the same ground in Annex A controls 8.15 (logging), 8.16 (monitoring activities) and 8.17 (clock synchronisation). The difference from an ordinary application or debug log is purpose and integrity: an audit trail is evidence, so it must be complete for the defined event set, attributable to an individual identity, and tamper-evident.

On Windows the Security event log is written by the Local Security Authority according to Advanced Audit Policy; frequently used event IDs include 4624 and 4625 (successful and failed logon), 4672 (special privileges assigned at logon), 4688 (process creation, optionally with command line), 4720 (account created), 4728/4732 (member added to a security group) and 1102 (audit log cleared). PowerShell script block logging (event 4104) and Sysmon add depth. On Linux the kernel audit subsystem, controlled by auditd and rules such as -w /etc/shadow -p wa -k shadow, records syscalls with the loginuid (auid) that survives sudo and su, so actions remain attributable to the original user. Databases, SaaS platforms and business applications have their own audit trails, which are often the only place that records who read a specific patient record or case file.

Integrity is the hard part, because an attacker with administrative rights on a host can stop or clear local logs (MITRE ATT&CK T1070.001 and T1562.002). The standard countermeasures are real-time forwarding to a separate collector or SIEM that the host's administrators cannot modify, WORM or immutable object storage, hash chaining or signed log batches so gaps and edits become detectable, and alerting on the audit service itself stopping or the log being cleared. Separation of duties matters: system administrators should not be able to alter the trail of their own actions. Synchronised clocks (NTP, ideally with UTC timestamps) are a prerequisite for correlating events across systems.

Design mistakes are common in both directions. Logging too little misses reads of sensitive data, which is exactly what investigations of insider misuse need; logging too much drowns detection and can itself create a personal-data problem, since audit logs are personal data under GDPR and require a legal basis, purpose limitation, access control and a defined retention period. OWASP lists security logging and alerting failures as A09 in its Top 10:2025. An audit log is not an audit: the log is the system's record, while an audit is an independent assessment that frequently samples that record to test whether controls such as access reviews actually operated.