Audit Logging

Two distinct kinds of logs, often confused:

• Application logs / debug logs — for engineers debugging behavior. Verbose, ephemeral, may include things you wouldn't want in a permanent record.
• Audit logs — for compliance, security forensics, and FERPA's required disclosure log. Structured, append-only, retained, tamper-evident, narrowly scoped.

This skill is mostly about audit logs. The two should be on separate pipes with separate retention and separate access controls. Mixing them is how PII ends up in Datadog forever.

What an audit log entry must contain

Every audit event captures, at minimum: