Research: Audit logs
What an Audit Log Can—and Cannot—Prove
Audit logs record what systems observed. Their value depends on identity, completeness, time and integrity.
Audit Log Retention: What to Record and Protect
A useful audit log names the actor, action, target, time and outcome without becoming a second secrets database.