---
title: "Audit Logging System"
---

# Audit Logging System

:::note[Planned]
Built-in audit logging is planned for HeliosDB Lite. In the current release the
`[audit]` section of `config.toml` is accepted but has no effect, and no
`__audit_log` table is written. To keep an audit trail today, record changes with
triggers (see [Recording changes with triggers](#recording-changes-with-triggers)).
:::

## Planned Design

The audit log will record, per operation:

- **What**: DDL (CREATE, ALTER, DROP), DML (INSERT, UPDATE, DELETE), and optionally
  SELECT and transaction statements (BEGIN, COMMIT, ROLLBACK).
- **Who and when**: user, session, timestamp.
- **Outcome**: affected rows, success or failure, error message.
- **Integrity**: a SHA-256 checksum per event for tamper detection.

It will be queryable with SQL from an append-only `__audit_log` table and configured
in the `[audit]` section of `config.toml`:

```toml
[audit]
enabled = true
log_ddl = true
log_dml = true
log_select = false
log_transactions = false
log_auth = true
retention_days = 90
enable_checksums = true
max_query_length = 10000
```

## Recording Changes with Triggers

Until built-in audit logging is available, `AFTER INSERT OR UPDATE OR DELETE` triggers on
sensitive tables can write each change to an audit table you own. Grant auditors
`SELECT` on that table and revoke write access from application roles. See
[Triggers](/docs/lite/features/triggers/) and
[Procedural Language](/docs/lite/features/procedural-language/) for the syntax.

## Related Controls Available Today

- **Encryption at rest**: [Encryption Quick Start](/docs/lite/guides/encryption_quickstart/)
- **Encryption in transit**: [PostgreSQL SSL/TLS Configuration](/docs/lite/guides/postgresql_ssl_configuration/)
- **Access control**: SQL roles, `GRANT` / `REVOKE` and [row-level security](/docs/lite/features/rls/)
- **Point-in-time reads**: [Time-Travel Queries](/docs/lite/features/time-travel/) show
  what a row contained at an earlier time