module

Logarithm::Audit

Enhanced security and operational audit logging system.

This module provides comprehensive audit logging for security, compliance, and operational monitoring. It supports structured logging with context, user tracking, compliance requirements, and audit trail management.

Audit Event Categories

Security Events

  • authentication: User login/logout events
  • authorization: Access control decisions
  • access_attempt: Resource access attempts
  • security_violation: Security policy violations

Operational Events

  • system_start: Application startup
  • system_shutdown: Application shutdown
  • config_change: Configuration modifications
  • model_update: ML model changes

ML/AI Events

  • training_start: Model training initiated
  • training_complete: Model training finished
  • prediction_made: Anomaly prediction performed
  • model_validation: Model performance validation

Compliance Events

  • data_access: Log data access for compliance
  • retention_policy: Data retention actions
  • audit_review: Audit log access

Audit Log Format

All events follow a standardized JSON structure:

{
  "event_id": "uuid",
  "event_type": "training_start",
  "timestamp": "2024-01-01T12:00:00Z",
  "severity": "info",
  "user_id": "system",
  "session_id": "session_uuid",
  "source_ip": "127.0.0.1",
  "resource": "/api/v1/train",
  "action": "POST",
  "status": "success",
  "details": {...},
  "compliance_flags": ["GDPR", "SOX"]
}

Compliance Support

The audit system supports multiple compliance frameworks:

  • GDPR: Data protection and privacy
  • SOX: Financial reporting controls
  • PCI-DSS: Payment card industry security
  • HIPAA: Healthcare data protection

Usage Examples

# Security events
Audit.log_security_event("authentication", "login_success", user_id: "user123")

# Operational events
Audit.log_operation("model_training", "start", details: {"duration" => "24h"})

# Compliance events
Audit.log_compliance("data_access", "log_review", compliance_flags: ["GDPR"])

# ML events
Audit.log_ml_event("prediction", "anomaly_detected", score: 0.95)

Class methods

enabled=(value : Bool)
Source
enabled?
Source
log_access_attempt(resource : String, success : Bool, error : String | Nil = nil)
Source
log_anomaly_detected(error : Float64, log : String)
Source
log_cli_monitoring_start(user_id : String = "system", log_paths : Array(String) = [] of String, stdin_mode : Bool = false, session_id : String | Nil = nil)
Source
log_cli_prediction(user_id : String, log_entry : String, anomaly_score : Float64, threshold : Float64, is_anomaly : Bool, session_id : String | Nil = nil)
Source
log_cli_training_start(user_id : String = "system", duration : Time::Span | Nil = nil, log_paths : Array(String) = [] of String, retrain_mode : String = "incremental", session_id : String | Nil = nil)

Enhanced CLI operation audit methods

Source
log_compliance(event_type : String, action : String, user_id : String = "system", session_id : String | Nil = nil, source_ip : String | Nil = nil, resource : String | Nil = nil, status : String = "success", details : Hash(String, JSON::Any) = {} of String => JSON::Any, compliance_flags : Array(ComplianceFlag) = [] of ComplianceFlag)

Compliance event logging

Source
log_config_change(user_id : String, config_key : String, old_value : String | Nil = nil, new_value : String | Nil = nil, session_id : String | Nil = nil)
Source
log_config_load(success : Bool, error : String | Nil = nil)
Source
log_data_retention(user_id : String, action : String, data_type : String, records_affected : Int64, retention_period : String, session_id : String | Nil = nil)
Source
log_ml_event(event_type : String, action : String, user_id : String = "system", session_id : String | Nil = nil, source_ip : String | Nil = nil, resource : String | Nil = nil, status : String = "success", details : Hash(String, JSON::Any) = {} of String => JSON::Any, compliance_flags : Array(ComplianceFlag) = [] of ComplianceFlag)

ML/AI event logging

Source
log_model_validation(user_id : String, accuracy_score : Float64, precision : Float64, recall : Float64, f1_score : Float64, session_id : String | Nil = nil)
Source
log_monitoring_start(log_paths : Array(String))
Source
log_operation(event_type : String, action : String, user_id : String = "system", session_id : String | Nil = nil, source_ip : String | Nil = nil, resource : String | Nil = nil, status : String = "success", severity : EventSeverity = EventSeverity::INFO, details : Hash(String, JSON::Any) = {} of String => JSON::Any, compliance_flags : Array(ComplianceFlag) = [] of ComplianceFlag)

Operational event logging

Source
log_training_complete(log_count : Int32)
Source
log_training_start(duration : Time::Span, log_paths : Array(String))

Legacy methods for backward compatibility

Source

Nested types