Problem/Motivation
The module stores audit trail events exclusively in the database. Operational teams often need these events in centralized logging infrastructure (ELK, Graylog, SIEM, Datadog) for security monitoring, compliance, and alerting.
Currently there is no way to forward audit events to PSR-3 loggers without writing custom code.
A merge request with the full implementation is being prepared and will be attached shortly.
Steps to reproduce
- Enable admin_audit_trail and perform CUD operations
- Events are only visible in /admin/reports/audit-trail (database)
- No events appear in syslog or any external logging backend
Proposed resolution
Add a sub-module admin_audit_trail_logger that:
- Implements
hook_admin_audit_trail_log_alter()to emit a structured PSR-3 log message - Provides two modes: hybrid (DB + PSR-3) or PSR-3 only (skips DB write)
- Exposes a simple config form (mode + channel) at
/admin/config/development/audit-trail/logger - Defaults severity to
notice, with per-operation override possible viasettings.php - Validates severity against
Psr\Log\LogLevelconstants to prevent runtime errors
Required parent module change (1 line): early return in admin_audit_trail_insert() when $log['skip_db'] is set by an alter hook. This is a no-op for existing installations (the flag is never set unless the sub-module sets it).
<?php
// After invokeAll('admin_audit_trail_log_alter'):
if (!empty($log['skip_db'])) {
return;
}
Log format:
[{type}] {operation}: {description} (uid={uid}, ip={ip}, path={path})
API changes
- New $log['skip_db'] flag in hook_admin_audit_trail_log_alter() — when set to TRUE, the parent module skips database insertion
- Documented in admin_audit_trail.api.php
Data model changes
- N/A
Release notes snippet
- New sub-module Admin Audit Trail Logger: forwards all audit events to Drupal's PSR-3 logger (syslog, Monolog, etc.). Supports hybrid or PSR-3-only mode.
Issue fork admin_audit_trail-3594471
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
rajab natshah