Audit Log
Append-only JSONL audit trail of every privileged action in NoSqlStudio. Used as LGPD Art. 37 evidence, SOX change records, and incident triage.
What it is
NoSqlStudio writes a single consolidated log file at userData/AuditLog/audit.jsonl. Every privileged action emits one JSON line: timestamp, actor (OS user + license id), source module (datamask / db-copy / ddl / connections / license / rs-broadcast), action verb, target namespace, and an outcome. Lines are append-only and never edited — tamper-resistance is structural.
When to use
Pull the audit log when you need to answer "who masked which collection, when, and with what policy?", reconstruct a DDL timeline before a post-incident review, or hand evidence to ANPD / DPO / external auditor for an LGPD / SOX investigation.
How to open
- In the NoSqlStudio desktop app, open the Tools menu → Audit Log, or press Ctrl+Alt+Shift+L.
- A new workspace tab opens listing the most recent audit records first. The filter bar on top filters by source / action / outcome.
- Click any row to expand the full JSON envelope including action-specific payload (DataMask policy fingerprint, DB Copy plan hash, DDL command, etc.).
Working with the log
- Filter — narrow by source module (datamask / db-copy / ddl / connections / license / rs-broadcast), action (start / finish / abort / create / drop), or outcome (success / failure / skipped).
- Export — the "Export filtered" button writes the current selection as a CSV file you can attach to a ticket or upload to a compliance archive.
- Tail — keep the workspace tab open during a maintenance window; new audit lines appear on top in real time as the engines emit them.
- Local-first — the file lives under your OS user data dir. There is no remote sink in v1; back it up like any other local artifact (rsync / OS file backup).
Audit sources wired today
These engines emit audit lines automatically — no extra configuration:
- DataMask — mask.start / mask.finish with policy fingerprint and target namespaces.
- DB Copy + DB Sync + DB Resolve — copy.finish / sync.finish / resolve.finish with plan and result snapshots.
- DDL — database.create / collection.create / collection.drop / database.drop / view.create / index.create.
- Connections — connection.connect / connection.disconnect with outcome (success / cancelled / error).
- Licensing — license.activate / license.deactivate.
- Replica Set Broadcast — rs-broadcast.execute (every fan-out command).
Limitations (v1)
- Local file only — no remote SIEM sink yet. Plan an OS-level backup or rsync to your evidence vault.
- Fire-and-forget from the renderer for some sources; if the main process crashes mid-write, the partial line is dropped (atomic appends mitigate this).
- role.drop and view.drop events are not emitted in v1 because the UI does not expose those operations.