Design Audit Logging - System Design | WinJob

Problem Statement and Audit Logging Mission

Separate security audit events from noisy application debug logs—auditors need who/what/when/where/outcome, not stack traces.
Treat audit logs as evidence: append-only, tamper-evident, independently replicated, with legal-hold workflows.
Multi-tenant SaaS must enforce tenant-scoped visibility in the query planner, not only UI filters.

Mechanism

Producers emit structured events to a local agent buffer; collectors batch to a partitioned stream; enrichers attach identity, policy version, and resource lineage; writers commit to hot search tier plus immutable cold object storage with hash-chain checkpoints.

Failure drills

If the collector buffer fills, producers switch to spill-to-disk with backpressure signals—never silently drop admin or auth events. If enrichment identity graph is stale, stamp enrichment_stale=true and route high-risk classes to synchronous path. If clock skew exceeds 30s, reject event or dual-stamp with ingest time and flag time_untrusted. If cross-region replication lag breaches RPO, pause legal-hold exports and page compliance.

Cost and capacity

Signal	Target
Peak audit EPS	850K /s
Hot retention	400 days
Cold WORM	7 years
P99 ingest	2.5 s

javaOne Dark Pro

1 public record AuditEvent(String eventId, String tenantId, String actorId, String action, Instant eventTime) {
2   public String partitionKey() { return tenantId + ":" + action; }
3 }

pythonOne Dark Pro

1 def is_high_risk(action: str) -> bool:
2     return action in {"iam.policy.update", "secret.read", "user.impersonate"}

typescriptOne Dark Pro

1 export interface AuditEvent { eventId: string; tenantId: string; actorId: string; action: string; outcome: "allow" | "deny"; }

Why interviewers care

Audit Logging interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and Audit Logging Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Separate **security audit events** from noisy application debug logs—auditors ne
•Metrics: Peak audit EPS, Hot retention, Cold WORM, P99 ingest
•Treat audit logs as **evidence**: append-only, tamper-evident, independently rep

1	public record AuditEvent(String eventId, String tenantId, String actorId, String action, Instant eventTime) {
2	public String partitionKey() { return tenantId + ":" + action; }
3	}

1	def is_high_risk(action: str) -> bool:
2	return action in {"iam.policy.update", "secret.read", "user.impersonate"}