What is a database audit log?¶
A database audit log records selected activity involving a database and the information stored within it.
It may show logins, queries, record access, changes, deletions, permission changes and administrative actions.
Avoid this assumption: That a database audit entry provides a complete history of every record viewed or changed and identifies the person responsible. That should not be assumed.
Database auditing is configurable. Some systems record only administrator activity. Others record selected tables, commands or failed attempts. Detailed auditing may be disabled because of storage or performance concerns.
An entry may contain the database account, client address, application, command, object affected, result, session ID and timestamp. This can help establish that a particular account or process queried, inserted, updated or deleted data.
But database accounts may be shared by an application serving many users. The log may therefore identify the application account rather than the end user. Automated jobs, stored procedures, replication and maintenance tools may also generate entries.
Even where a named user appears, the record does not automatically prove that person was at the keyboard. Existing sessions, compromised credentials and administrative impersonation must be considered.
Investigators should establish which auditing features were enabled and what activity was excluded. Ask whether the connection came directly from a user or through an application layer. Obtain schema information, field definitions, session or transaction identifiers and relevant application logs.
Preserve original database records and surrounding events. Where a change is important, compare before-and-after data, transaction history, backups and application audit records. Seek specialist support where query behaviour or database architecture affects interpretation.
Operational takeaway¶
A database audit log can show recorded activity against a database, but coverage, shared application accounts, automation and attribution determine what the entry actually proves.