Problem/Motivation

The module stores audit trail events exclusively in the database. Operational teams often need these events in centralized logging infrastructure (ELK, Graylog, SIEM, Datadog) for security monitoring, compliance, and alerting.

Currently there is no way to forward audit events to PSR-3 loggers without writing custom code.

A merge request with the full implementation is being prepared and will be attached shortly.

Steps to reproduce

  1. Enable admin_audit_trail and perform CUD operations
  2. Events are only visible in /admin/reports/audit-trail (database)
  3. No events appear in syslog or any external logging backend

Proposed resolution

Add a sub-module admin_audit_trail_logger that:

  • Implements hook_admin_audit_trail_log_alter() to emit a structured PSR-3 log message
  • Provides two modes: hybrid (DB + PSR-3) or PSR-3 only (skips DB write)
  • Exposes a simple config form (mode + channel) at /admin/config/development/audit-trail/logger
  • Defaults severity to notice, with per-operation override possible via settings.php
  • Validates severity against Psr\Log\LogLevel constants to prevent runtime errors

Required parent module change (1 line): early return in admin_audit_trail_insert() when $log['skip_db'] is set by an alter hook. This is a no-op for existing installations (the flag is never set unless the sub-module sets it).

<?php
// After invokeAll('admin_audit_trail_log_alter'):
if (!empty($log['skip_db'])) {
  return;
}

Log format:
[{type}] {operation}: {description} (uid={uid}, ip={ip}, path={path})

API changes

  • New $log['skip_db'] flag in hook_admin_audit_trail_log_alter() — when set to TRUE, the parent module skips database insertion
  • Documented in admin_audit_trail.api.php

Data model changes

  • N/A

Release notes snippet

  • New sub-module Admin Audit Trail Logger: forwards all audit events to Drupal's PSR-3 logger (syslog, Monolog, etc.). Supports hybrid or PSR-3-only mode.
Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

sillot created an issue. See original summary.

rajab natshah’s picture

Status: Active » Needs review