[{"data":1,"prerenderedAt":1019},["ShallowReactive",2],{"navigation_docs":3,"-logging-audit-compliance":454,"-logging-audit-compliance-surround":1014},[4,35,159,201,289,352,438],{"title":5,"path":6,"stem":7,"children":8,"page":34},"Getting Started","\u002Fgetting-started","1.getting-started",[9,14,19,24,29],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-zap",{"title":25,"path":26,"stem":27,"icon":28},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","1.getting-started\u002F4.agent-skills","i-lucide-sparkles",{"title":30,"path":31,"stem":32,"icon":33},"vs Other Loggers","\u002Fgetting-started\u002Fvs-other-loggers","1.getting-started\u002F5.vs-other-loggers","i-lucide-scale",false,{"title":36,"path":37,"stem":38,"children":39,"page":34},"Logging","\u002Flogging","2.logging",[40,45,50,55,60,65,70,99,127],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Flogging\u002Foverview","2.logging\u002F0.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Simple Logging","\u002Flogging\u002Fsimple-logging","2.logging\u002F1.simple-logging","i-lucide-terminal",{"title":51,"path":52,"stem":53,"icon":54},"Wide Events","\u002Flogging\u002Fwide-events","2.logging\u002F2.wide-events","i-lucide-layers",{"title":56,"path":57,"stem":58,"icon":59},"Structured Errors","\u002Flogging\u002Fstructured-errors","2.logging\u002F3.structured-errors","i-lucide-shield-alert",{"title":61,"path":62,"stem":63,"icon":64},"Catalogs","\u002Flogging\u002Fcatalogs","2.logging\u002F4.catalogs","i-lucide-book-open",{"title":66,"path":67,"stem":68,"icon":69},"Client Logging","\u002Flogging\u002Fclient-logging","2.logging\u002F5.client-logging","i-lucide-monitor",{"title":71,"icon":72,"path":73,"stem":74,"children":75,"page":34},"AI SDK","i-simple-icons-vercel","\u002Flogging\u002Fai-sdk","2.logging\u002F6.ai-sdk",[76,79,84,89,94],{"title":41,"path":77,"stem":78,"icon":44},"\u002Flogging\u002Fai-sdk\u002Foverview","2.logging\u002F6.ai-sdk\u002F01.overview",{"title":80,"path":81,"stem":82,"icon":83},"Usage","\u002Flogging\u002Fai-sdk\u002Fusage","2.logging\u002F6.ai-sdk\u002F02.usage","i-lucide-code",{"title":85,"path":86,"stem":87,"icon":88},"Options","\u002Flogging\u002Fai-sdk\u002Foptions","2.logging\u002F6.ai-sdk\u002F03.options","i-lucide-sliders",{"title":90,"path":91,"stem":92,"icon":93},"Metadata","\u002Flogging\u002Fai-sdk\u002Fmetadata","2.logging\u002F6.ai-sdk\u002F04.metadata","i-lucide-database",{"title":95,"path":96,"stem":97,"icon":98},"Telemetry","\u002Flogging\u002Fai-sdk\u002Ftelemetry","2.logging\u002F6.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":100,"icon":101,"path":102,"stem":103,"children":104,"page":34},"Better Auth","i-simple-icons-betterauth","\u002Flogging\u002Fbetter-auth","2.logging\u002F7.better-auth",[105,108,113,118,122],{"title":41,"path":106,"stem":107,"icon":44},"\u002Flogging\u002Fbetter-auth\u002Foverview","2.logging\u002F7.better-auth\u002F01.overview",{"title":109,"path":110,"stem":111,"icon":112},"Identify User","\u002Flogging\u002Fbetter-auth\u002Fidentify-user","2.logging\u002F7.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":114,"path":115,"stem":116,"icon":117},"Middleware","\u002Flogging\u002Fbetter-auth\u002Fmiddleware","2.logging\u002F7.better-auth\u002F03.middleware","i-lucide-shield",{"title":119,"path":120,"stem":121,"icon":69},"Client Sync","\u002Flogging\u002Fbetter-auth\u002Fclient-sync","2.logging\u002F7.better-auth\u002F04.client-sync",{"title":123,"path":124,"stem":125,"icon":126},"Performance","\u002Flogging\u002Fbetter-auth\u002Fperformance","2.logging\u002F7.better-auth\u002F05.performance","i-lucide-gauge",{"title":128,"icon":129,"path":130,"stem":131,"children":132,"page":34},"Audit Logs","i-lucide-shield-check","\u002Flogging\u002Faudit","2.logging\u002F8.audit",[133,136,141,146,151,155],{"title":41,"path":134,"stem":135,"icon":44},"\u002Flogging\u002Faudit\u002Foverview","2.logging\u002F8.audit\u002F01.overview",{"title":137,"path":138,"stem":139,"icon":140},"Schema","\u002Flogging\u002Faudit\u002Fschema","2.logging\u002F8.audit\u002F02.schema","i-lucide-file-text",{"title":142,"path":143,"stem":144,"icon":145},"Recording","\u002Flogging\u002Faudit\u002Frecording","2.logging\u002F8.audit\u002F03.recording","i-lucide-pen-line",{"title":147,"path":148,"stem":149,"icon":150},"Drains","\u002Flogging\u002Faudit\u002Fpipeline","2.logging\u002F8.audit\u002F04.pipeline","i-lucide-link",{"title":152,"path":153,"stem":154,"icon":129},"Compliance","\u002Flogging\u002Faudit\u002Fcompliance","2.logging\u002F8.audit\u002F05.compliance",{"title":156,"path":157,"stem":158,"icon":64},"Recipes","\u002Flogging\u002Faudit\u002Frecipes","2.logging\u002F8.audit\u002F06.recipes",{"title":160,"path":161,"stem":162,"children":163,"page":34},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[164,169,174,179,184,188,191,196],{"title":165,"path":166,"stem":167,"icon":168},"Lifecycle","\u002Fcore-concepts\u002Flifecycle","3.core-concepts\u002F0.lifecycle","i-lucide-arrow-right-left",{"title":170,"path":171,"stem":172,"icon":173},"Configuration","\u002Fcore-concepts\u002Fconfiguration","3.core-concepts\u002F1.configuration","i-lucide-settings",{"title":175,"path":176,"stem":177,"icon":178},"Sampling","\u002Fcore-concepts\u002Fsampling","3.core-concepts\u002F2.sampling","i-lucide-filter",{"title":180,"path":181,"stem":182,"icon":183},"Typed Fields","\u002Fcore-concepts\u002Ftyped-fields","3.core-concepts\u002F3.typed-fields","i-simple-icons-typescript",{"title":185,"path":186,"stem":187,"icon":129},"Best Practices","\u002Fcore-concepts\u002Fbest-practices","3.core-concepts\u002F4.best-practices",{"title":123,"path":189,"stem":190,"icon":126},"\u002Fcore-concepts\u002Fperformance","3.core-concepts\u002F5.performance",{"title":192,"path":193,"stem":194,"icon":195},"Vite Plugin","\u002Fcore-concepts\u002Fvite-plugin","3.core-concepts\u002F6.vite-plugin","i-custom-vite",{"title":197,"path":198,"stem":199,"icon":200},"Auto-Redaction","\u002Fcore-concepts\u002Fredaction","3.core-concepts\u002F7.redaction","i-lucide-eye-off",{"title":202,"path":203,"stem":204,"children":205,"page":34},"Frameworks","\u002Fframeworks","4.frameworks",[206,210,215,220,225,230,235,240,245,250,255,260,265,270,274,279,284],{"title":41,"path":207,"stem":208,"icon":209},"\u002Fframeworks\u002Foverview","4.frameworks\u002F00.overview","i-lucide-layout-grid",{"title":211,"path":212,"stem":213,"icon":214},"Nuxt","\u002Fframeworks\u002Fnuxt","4.frameworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":216,"path":217,"stem":218,"icon":219},"Next.js","\u002Fframeworks\u002Fnextjs","4.frameworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":221,"path":222,"stem":223,"icon":224},"SvelteKit","\u002Fframeworks\u002Fsveltekit","4.frameworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":226,"path":227,"stem":228,"icon":229},"Nitro","\u002Fframeworks\u002Fnitro","4.frameworks\u002F04.nitro","i-custom-nitro",{"title":231,"path":232,"stem":233,"icon":234},"TanStack Start","\u002Fframeworks\u002Ftanstack-start","4.frameworks\u002F05.tanstack-start","i-custom-tanstack",{"title":236,"path":237,"stem":238,"icon":239},"NestJS","\u002Fframeworks\u002Fnestjs","4.frameworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":241,"path":242,"stem":243,"icon":244},"Express","\u002Fframeworks\u002Fexpress","4.frameworks\u002F07.express","i-simple-icons-express",{"title":246,"path":247,"stem":248,"icon":249},"Hono","\u002Fframeworks\u002Fhono","4.frameworks\u002F08.hono","i-simple-icons-hono",{"title":251,"path":252,"stem":253,"icon":254},"Fastify","\u002Fframeworks\u002Ffastify","4.frameworks\u002F09.fastify","i-simple-icons-fastify",{"title":256,"path":257,"stem":258,"icon":259},"Elysia","\u002Fframeworks\u002Felysia","4.frameworks\u002F10.elysia","i-custom-elysia",{"title":261,"path":262,"stem":263,"icon":264},"React Router","\u002Fframeworks\u002Freact-router","4.frameworks\u002F11.react-router","i-custom-reactrouter",{"title":266,"path":267,"stem":268,"icon":269},"Cloudflare Workers","\u002Fframeworks\u002Fcloudflare-workers","4.frameworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":271,"path":272,"stem":273,"icon":183},"Standalone","\u002Fframeworks\u002Fstandalone","4.frameworks\u002F13.standalone",{"title":275,"path":276,"stem":277,"icon":278},"Astro","\u002Fframeworks\u002Fastro","4.frameworks\u002F14.astro","i-simple-icons-astro",{"title":280,"path":281,"stem":282,"icon":283},"AWS Lambda","\u002Fframeworks\u002Faws-lambda","4.frameworks\u002F16.aws-lambda","i-custom-lambda",{"title":285,"path":286,"stem":287,"icon":288},"Custom Integration","\u002Fframeworks\u002Fcustom-integration","4.frameworks\u002F17.custom-integration","i-lucide-puzzle",{"title":290,"path":291,"stem":292,"children":293,"page":34},"Build on top","\u002Fbuild-on-top","5.build-on-top",[294,297,302,307,312,316,321,326,330,334,338,342,347],{"title":41,"path":295,"stem":296,"icon":54},"\u002Fbuild-on-top\u002Foverview","5.build-on-top\u002F0.overview",{"title":298,"path":299,"stem":300,"icon":301},"In-process stream","\u002Fbuild-on-top\u002Fin-process-stream","5.build-on-top\u002F1.in-process-stream","i-lucide-radio-tower",{"title":303,"path":304,"stem":305,"icon":306},"Fanout","\u002Fbuild-on-top\u002Ffanout-and-multi-drain","5.build-on-top\u002F10.fanout-and-multi-drain","i-lucide-share-2",{"title":308,"path":309,"stem":310,"icon":311},"Identity headers","\u002Fbuild-on-top\u002Fidentity-headers","5.build-on-top\u002F11.identity-headers","i-lucide-fingerprint",{"title":313,"path":314,"stem":315,"icon":288},"Custom framework","\u002Fbuild-on-top\u002Fcustom-framework","5.build-on-top\u002F12.custom-framework",{"title":317,"path":318,"stem":319,"icon":320},"Stream server","\u002Fbuild-on-top\u002Fstream-server","5.build-on-top\u002F2.stream-server","i-lucide-radio",{"title":322,"path":323,"stem":324,"icon":325},"FS reader","\u002Fbuild-on-top\u002Ffs-reader","5.build-on-top\u002F3.fs-reader","i-lucide-folder-search",{"title":156,"path":327,"stem":328,"icon":329},"\u002Fbuild-on-top\u002Fconsumer-recipes","5.build-on-top\u002F4.consumer-recipes","i-lucide-chef-hat",{"title":331,"path":332,"stem":333,"icon":288},"Plugins","\u002Fbuild-on-top\u002Fplugins","5.build-on-top\u002F5.plugins",{"title":335,"path":336,"stem":337,"icon":28},"Custom enrichers","\u002Fbuild-on-top\u002Fcustom-enrichers","5.build-on-top\u002F6.custom-enrichers",{"title":339,"path":340,"stem":341,"icon":178},"Tail sampling","\u002Fbuild-on-top\u002Ftail-sampling","5.build-on-top\u002F7.tail-sampling",{"title":343,"path":344,"stem":345,"icon":346},"Custom drains","\u002Fbuild-on-top\u002Fcustom-drains","5.build-on-top\u002F8.custom-drains","i-lucide-code-2",{"title":348,"path":349,"stem":350,"icon":351},"Drain pipeline","\u002Fbuild-on-top\u002Fdrain-pipeline","5.build-on-top\u002F9.drain-pipeline","i-lucide-workflow",{"title":353,"path":354,"stem":355,"children":356,"page":34},"Adapters","\u002Fadapters","6.adapters",[357,360,400,415],{"title":41,"path":358,"stem":359,"icon":44},"\u002Fadapters\u002Foverview","6.adapters\u002F01.overview",{"title":361,"path":362,"stem":363,"children":364,"page":34},"Cloud destinations","\u002Fadapters\u002Fcloud","6.adapters\u002F02.cloud",[365,370,375,380,385,390,395],{"title":366,"path":367,"stem":368,"icon":369},"Axiom","\u002Fadapters\u002Fcloud\u002Faxiom","6.adapters\u002F02.cloud\u002F01.axiom","i-custom-axiom",{"title":371,"path":372,"stem":373,"icon":374},"OTLP","\u002Fadapters\u002Fcloud\u002Fotlp","6.adapters\u002F02.cloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":376,"path":377,"stem":378,"icon":379},"PostHog","\u002Fadapters\u002Fcloud\u002Fposthog","6.adapters\u002F02.cloud\u002F03.posthog","i-simple-icons-posthog",{"title":381,"path":382,"stem":383,"icon":384},"Sentry","\u002Fadapters\u002Fcloud\u002Fsentry","6.adapters\u002F02.cloud\u002F04.sentry","i-simple-icons-sentry",{"title":386,"path":387,"stem":388,"icon":389},"Better Stack","\u002Fadapters\u002Fcloud\u002Fbetter-stack","6.adapters\u002F02.cloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":391,"path":392,"stem":393,"icon":394},"Datadog","\u002Fadapters\u002Fcloud\u002Fdatadog","6.adapters\u002F02.cloud\u002F06.datadog","i-simple-icons-datadog",{"title":396,"path":397,"stem":398,"icon":399},"HyperDX","\u002Fadapters\u002Fcloud\u002Fhyperdx","6.adapters\u002F02.cloud\u002F07.hyperdx","i-custom-hyperdx",{"title":401,"path":402,"stem":403,"children":404,"page":34},"Self-hosted","\u002Fadapters\u002Fself-hosted","6.adapters\u002F03.self-hosted",[405,410],{"title":406,"path":407,"stem":408,"icon":409},"File System","\u002Fadapters\u002Fself-hosted\u002Ffs","6.adapters\u002F03.self-hosted\u002F01.fs","i-lucide-hard-drive",{"title":411,"path":412,"stem":413,"icon":414},"NuxtHub","\u002Fadapters\u002Fself-hosted\u002Fnuxthub","6.adapters\u002F03.self-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":416,"path":417,"stem":418,"children":419,"page":34},"Building blocks","\u002Fadapters\u002Fbuilding-blocks","6.adapters\u002F04.building-blocks",[420,424,429,433],{"title":421,"path":422,"stem":423,"icon":351},"Pipeline","\u002Fadapters\u002Fbuilding-blocks\u002Fpipeline","6.adapters\u002F04.building-blocks\u002F01.pipeline",{"title":425,"path":426,"stem":427,"icon":428},"HTTP","\u002Fadapters\u002Fbuilding-blocks\u002Fhttp","6.adapters\u002F04.building-blocks\u002F02.http","i-lucide-globe",{"title":430,"path":431,"stem":432,"icon":83},"Custom Adapters","\u002Fadapters\u002Fbuilding-blocks\u002Fcustom","6.adapters\u002F04.building-blocks\u002F03.custom",{"title":434,"path":435,"stem":436,"icon":437},"Toolkit","\u002Fadapters\u002Fbuilding-blocks\u002Ftoolkit","6.adapters\u002F04.building-blocks\u002F04.toolkit","i-lucide-blocks",{"title":439,"path":440,"stem":441,"children":442,"page":34},"Enrichers","\u002Fenrichers","7.enrichers",[443,446,450],{"title":41,"path":444,"stem":445,"icon":28},"\u002Fenrichers\u002Foverview","7.enrichers\u002F1.overview",{"title":447,"path":448,"stem":449,"icon":288},"Built-in","\u002Fenrichers\u002Fbuilt-in","7.enrichers\u002F2.built-in",{"title":451,"path":452,"stem":453,"icon":83},"Custom","\u002Fenrichers\u002Fcustom","7.enrichers\u002F3.custom",{"id":455,"title":152,"body":456,"description":1003,"extension":1004,"links":1005,"meta":1010,"navigation":1011,"path":153,"seo":1012,"stem":154,"__hash__":1013},"docs\u002F2.logging\u002F8.audit\u002F05.compliance.md",{"type":457,"value":458,"toc":996},"minimark",[459,472,477,480,593,616,625,629,636,760,798,802,805,818,831,835,838,897,900,904,992],[460,461,462,463,467,468,471],"p",{},"Compliance frameworks (SOC2, HIPAA, GDPR, PCI) ask the same five questions of every audit log: ",[464,465,466],"strong",{},"who, what, when, from where, with which outcome",", plus ",[464,469,470],{},"how do we know it wasn't tampered with",". evlog answers each one through composition of the existing primitives.",[473,474,476],"h2",{"id":475},"integrity","Integrity",[460,478,479],{},"Hash-chain the audit log so any tampering is detectable. Each event's hash includes the previous hash, so deleting a row breaks the chain forward of that point.",[481,482,487],"pre",{"className":483,"code":484,"language":485,"meta":486,"style":486},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","auditOnly(\n  signed(createFsDrain({ dir: '.audit' }), { strategy: 'hash-chain' }),\n  { await: true },\n)\n","typescript","",[488,489,490,503,569,587],"code",{"__ignoreMap":486},[491,492,495,499],"span",{"class":493,"line":494},"line",1,[491,496,498],{"class":497},"s2Zo4","auditOnly",[491,500,502],{"class":501},"sTEyZ","(\n",[491,504,506,509,512,515,517,521,525,528,531,535,538,541,544,547,550,553,555,557,560,562,564,566],{"class":493,"line":505},2,[491,507,508],{"class":497},"  signed",[491,510,511],{"class":501},"(",[491,513,514],{"class":497},"createFsDrain",[491,516,511],{"class":501},[491,518,520],{"class":519},"sMK4o","{",[491,522,524],{"class":523},"swJcz"," dir",[491,526,527],{"class":519},":",[491,529,530],{"class":519}," '",[491,532,534],{"class":533},"sfazB",".audit",[491,536,537],{"class":519},"'",[491,539,540],{"class":519}," }",[491,542,543],{"class":501},")",[491,545,546],{"class":519},",",[491,548,549],{"class":519}," {",[491,551,552],{"class":523}," strategy",[491,554,527],{"class":519},[491,556,530],{"class":519},[491,558,559],{"class":533},"hash-chain",[491,561,537],{"class":519},[491,563,540],{"class":519},[491,565,543],{"class":501},[491,567,568],{"class":519},",\n",[491,570,572,575,578,580,584],{"class":493,"line":571},3,[491,573,574],{"class":519},"  {",[491,576,577],{"class":523}," await",[491,579,527],{"class":519},[491,581,583],{"class":582},"sfNiH"," true",[491,585,586],{"class":519}," },\n",[491,588,590],{"class":493,"line":589},4,[491,591,592],{"class":501},")\n",[594,595,596,603,604,607,608,611,612,615],"warning",{},[464,597,598,599,602],{},"Rotate ",[488,600,601],{},"secret"," for HMAC-signed audits annually."," When you rotate, embed a key id alongside the signature (e.g. extend ",[488,605,606],{},"AuditFields"," with ",[488,609,610],{},"keyId"," via ",[488,613,614],{},"declare module",") so old events stay verifiable against the previous secret. Verifiers should look up the key by id, not assume a single global secret.",[460,617,618,619,624],{},"See ",[620,621,623],"a",{"href":622},"\u002Flogging\u002Faudit\u002Fpipeline#signed","Drains & Integrity"," for the difference between HMAC and hash-chain.",[473,626,628],{"id":627},"redact","Redact",[460,630,631,632,635],{},"Audit events run through your existing ",[488,633,634],{},"RedactConfig",". Compose with the strict audit preset to harden PII handling:",[481,637,639],{"className":483,"code":638,"language":485,"meta":486,"style":486},"import { auditRedactPreset } from 'evlog'\n\ninitLogger({\n  redact: {\n    paths: [\n      ...(auditRedactPreset.paths ?? []),\n      'user.password',\n    ],\n  },\n})\n",[488,640,641,665,671,681,691,702,725,738,746,752],{"__ignoreMap":486},[491,642,643,647,649,652,654,657,659,662],{"class":493,"line":494},[491,644,646],{"class":645},"s7zQu","import",[491,648,549],{"class":519},[491,650,651],{"class":501}," auditRedactPreset",[491,653,540],{"class":519},[491,655,656],{"class":645}," from",[491,658,530],{"class":519},[491,660,661],{"class":533},"evlog",[491,663,664],{"class":519},"'\n",[491,666,667],{"class":493,"line":505},[491,668,670],{"emptyLinePlaceholder":669},true,"\n",[491,672,673,676,678],{"class":493,"line":571},[491,674,675],{"class":497},"initLogger",[491,677,511],{"class":501},[491,679,680],{"class":519},"{\n",[491,682,683,686,688],{"class":493,"line":589},[491,684,685],{"class":523},"  redact",[491,687,527],{"class":519},[491,689,690],{"class":519}," {\n",[491,692,694,697,699],{"class":493,"line":693},5,[491,695,696],{"class":523},"    paths",[491,698,527],{"class":519},[491,700,701],{"class":501}," [\n",[491,703,705,708,711,714,717,720,723],{"class":493,"line":704},6,[491,706,707],{"class":519},"      ...",[491,709,710],{"class":501},"(auditRedactPreset",[491,712,713],{"class":519},".",[491,715,716],{"class":501},"paths ",[491,718,719],{"class":519},"??",[491,721,722],{"class":501}," [])",[491,724,568],{"class":519},[491,726,728,731,734,736],{"class":493,"line":727},7,[491,729,730],{"class":519},"      '",[491,732,733],{"class":533},"user.password",[491,735,537],{"class":519},[491,737,568],{"class":519},[491,739,741,744],{"class":493,"line":740},8,[491,742,743],{"class":501},"    ]",[491,745,568],{"class":519},[491,747,749],{"class":493,"line":748},9,[491,750,751],{"class":519},"  },\n",[491,753,755,758],{"class":493,"line":754},10,[491,756,757],{"class":519},"}",[491,759,592],{"class":501},[460,761,762,763,766,767,770,771,774,775,774,778,774,781,774,784,774,787,790,791,794,795,713],{},"The preset drops ",[488,764,765],{},"Authorization"," \u002F ",[488,768,769],{},"Cookie"," headers and common credential field names (",[488,772,773],{},"password",", ",[488,776,777],{},"token",[488,779,780],{},"apiKey",[488,782,783],{},"cardNumber",[488,785,786],{},"cvv",[488,788,789],{},"ssn",") wherever they appear inside ",[488,792,793],{},"audit.changes.before"," and ",[488,796,797],{},"audit.changes.after",[473,799,801],{"id":800},"gdpr-vs-append-only","GDPR vs append-only",[460,803,804],{},"Append-only audit logs collide with GDPR's right to be forgotten. Recommended pattern today:",[806,807,808,812,815],"ol",{},[809,810,811],"li",{},"Keep audit rows immutable.",[809,813,814],{},"Encrypt PII fields with a per-actor key (held outside the audit store).",[809,816,817],{},"To \"forget\" a user, delete their key — the audit row stays, the chain stays valid, the PII becomes unreadable.",[460,819,820,821,824,825,713],{},"A built-in ",[488,822,823],{},"cryptoShredding"," helper is on the ",[620,826,830],{"href":827,"rel":828},"https:\u002F\u002Fgithub.com\u002FHugoRCD\u002Fevlog\u002Fissues",[829],"nofollow","follow-up roadmap",[473,832,834],{"id":833},"retention","Retention",[460,836,837],{},"Retention is a storage-layer concern by design. evlog's audit layer doesn't enforce retention windows because every supported sink already has a stronger, audited mechanism for it. Pick the one matching your sink:",[839,840,841,854],"table",{},[842,843,844],"thead",{},[845,846,847,851],"tr",{},[848,849,850],"th",{},"Sink",[848,852,853],{},"Retention mechanism",[855,856,857,870,881,889],"tbody",{},[845,858,859,863],{},[860,861,862],"td",{},"FS",[860,864,865,866,869],{},"Combine ",[488,867,868],{},"createFsDrain({ maxFiles })"," with a daily compactor.",[845,871,872,875],{},[860,873,874],{},"Postgres",[860,876,877,878,713],{},"Schedule ",[488,879,880],{},"DELETE FROM audit_events WHERE timestamp \u003C now() - interval '7 years'",[845,882,883,886],{},[860,884,885],{},"Axiom \u002F Datadog \u002F Loki",[860,887,888],{},"Set the dataset retention policy in the platform.",[845,890,891,894],{},[860,892,893],{},"S3 Object Lock",[860,895,896],{},"Configure lifecycle rules + Object Lock retention period.",[460,898,899],{},"Document the chosen window in your security policy. Auditors care about the written rule, not the enforcing component.",[473,901,903],{"id":902},"common-pitfalls","Common Pitfalls",[905,906,907,920,943,949,968,982],"ul",{},[809,908,909,912,913,607,916,919],{},[464,910,911],{},"Logging only successes."," Auditors care most about denials. Always pair ",[488,914,915],{},"log.audit()",[488,917,918],{},"log.audit.deny()"," on the negative branch of every authorisation check.",[809,921,922,928,929,932,933,935,936,774,938,774,940,942],{},[464,923,924,925,713],{},"Leaking PII through ",[488,926,927],{},"changes"," ",[488,930,931],{},"auditDiff()"," runs through your ",[488,934,634],{},", but only if the field paths are listed. Add ",[488,937,773],{},[488,939,777],{},[488,941,780],{},", etc. once globally so you never have to think about it again.",[809,944,945,948],{},[464,946,947],{},"Treating audits as observability."," Don't sample, downsample, or summarise audit events. Force-keep is on by default — don't disable it.",[809,950,951,928,958,960,961,766,964,967],{},[464,952,953,954,957],{},"Conflating ",[488,955,956],{},"actor.id"," with the session id.",[488,959,956],{}," is the stable user id (or system identity). Correlate sessions via ",[488,962,963],{},"context.requestId",[488,965,966],{},"context.traceId",", never via the actor.",[809,969,970,973,974,977,978,981],{},[464,971,972],{},"Forgetting standalone jobs."," Cron tasks, queue workers, and CLIs trigger audit-worthy actions too. Use ",[488,975,976],{},"audit()"," (no request) or ",[488,979,980],{},"withAudit()"," to keep coverage parity with your HTTP routes.",[809,983,984,991],{},[464,985,986,987,990],{},"Skipping ",[488,988,989],{},"await: true"," on the audit drain."," Without it, audits are fire-and-forget — a crash between the event being emitted and the drain flushing means the action happened but no audit row exists.",[993,994,995],"style",{},"html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":486,"searchDepth":505,"depth":505,"links":997},[998,999,1000,1001,1002],{"id":475,"depth":505,"text":476},{"id":627,"depth":505,"text":628},{"id":800,"depth":505,"text":801},{"id":833,"depth":505,"text":834},{"id":902,"depth":505,"text":903},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.","md",[1006,1009],{"label":623,"icon":150,"to":148,"color":1007,"variant":1008},"neutral","subtle",{"label":156,"icon":64,"to":157,"color":1007,"variant":1008},{},{"title":152,"icon":129},{"title":152,"description":1003},"IyXFlsbKUUw38ViWHOK2P3nf1U68neZdA_NJqFNoilA",[1015,1017],{"title":147,"path":148,"stem":149,"description":1016,"icon":150,"children":-1},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.",{"title":156,"path":157,"stem":158,"description":1018,"icon":64,"children":-1},"File system, Axiom, and Postgres recipes for audit logs, plus mockAudit for tests and the full API reference.",1778340163851]