Comparison
Audit trailvsStructured logging
Audit trail
somebody asks who read the salary table last March and you can answer with a query rather than with a guess.
The retained record of who accessed or changed what, and when. In a warehouse it is unusually cheap to have, because the query history exists anyway, and unusually valuable during an incident or an investigation. It also doubles as the input to deprecation decisions and cost attribution, which is generally what gets it turned on before any regulator asks.
Full entry →Structured logging
you log an object with named fields instead of a sentence, so you can query on user id rather than grep for it.
Emitting logs as machine-parseable records with consistent field names. It turns logs into something queryable and aggregatable rather than something you read. The discipline is in the field names: a user id logged under four different keys is four fields that cannot be joined.
Full entry →