Audit Trail

In computer security systems, a chronological record of when users logged in, how long they were engaged in various activities, what they were doing, and whether any actual or attempted security violations occurred. An audit trail is an automated or manual set of chronological records of system activities that may enable the reconstruction and examination of a sequence of events and/or changes in an event.

A chronological record of activities that is sufficient to enable the reconstruction, review, and examination of the sequence of environments and activities

A record showing who has accessed an Information Technology (IT) system and what operations the user has performed during a given period.

1. A record of both completed and attempted accesses and service. 2. Data in the form of a logical path linking a sequence of events, used to trace the transactions that have affected the contents of a record. 3. [In INFOSEC, a] chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event. Note: Audit trail may apply to information in an information system (IS), to message routing in a communications system, or to the transfer of COMSEC material. [INFOSEC-99] 4. The set of records generated by a system in response to accounting operations, providing the basis for audit [CESG]. 5. See Security Audit Trail [7498-2]. 6. The destination of audit records that are recorded, and the source of records read by an audit post-processing application [POSIX.6]. 7. A set of records that collectively provide documentary evidence of processing used to aid in tracing from original transactions forward to related records and reports, and/or backwards from records and reports to their component source transactions [TCSEC].