Big Audit Entries

The ATNA audit scheme has been re-imagined inwards FHIR every bit the AuditEvent Resource. The reformatting is solely to encounter the...

The ATNA audit scheme has been re-imagined inwards FHIR every bit the AuditEvent Resource.

The reformatting is solely to encounter the FHIR audience expectations for readability. For this at that topographic point is actually useful datatypes, structure, referencing, too tooling. There is no intention to alter inwards whatever key way. There is a mapping betwixt the two that is expected to interpret frontward too backward without loss of data. The reality is at that topographic point powerfulness hold upward around cases where the mapping powerfulness hold upward lacking....

Small entries are large

One of the observations many brand most ATNA too AuditEvent is that the schema itself makes what could hold upward recorded inwards classic log file using a unproblematic unstructured string of most 115 character. The next instance comes from the examples inwards the FHIR AuditEvent for an Accounting of Disclosure Log Entry,

Disclosure yesteryear around idiot, for marketing reasons, to places unknown, of a Poor Sap, information most Everything important.

becomes a 4604 graphic symbol XML object or a 4156 graphic symbol JSON object (Hmm, json is smaller, but non yesteryear much).

THIS is a ridiculous example, every bit the string clearly is non sufficient, but the betoken I exercise desire to brand is that adding construction volition brand the infinite needed to hold upward larger.

This is a tradeoff that is just a fact of the departure betwixt unstructured strings, too a structured too coded object. The string powerfulness hold upward useful, but frequently needs exceptional processing to instruct the information embedded inwards that string. More frequently inwards a string world, on an log analysis must correlate many log entries to instruct the total story.

The betoken of ATNA too AuditEvent is that the master copy tape knew just the values of Who, What, Where, When, Why, How, etc... then the destination of ATNA too AuditEvent is to supply good defined ways to tape this then that it doesn't involve to hold upward guessed at.

So reality is that an ATNA or AuditEvent is probable larger than a string... but most 'happy path' audit log entries are 1-2 k inwards size. Not small, but also non big.

Big log entries

The work is that at that topographic point are occasionally cases, failure-modes, where to a greater extent than information would hold upward useful to hold upward recorded. Such every bit when at that topographic point is a technical failure, ane powerfulness desire to tape the 'stack trace'. Or when a asking is rejected, ane powerfulness desire to tape to a greater extent than fully the asking details too reply fault message.

Or around desire to tape the results of a Query, something I caution against every bit it fills the audit log alongside information that is easily re-created. Often these results are saved inwards other databases locally, then inwards that instance just link the AuditEvent alongside that database entry. This could hold upward done yesteryear just putting a database index into a AuditEvent.entity.

So sometimes at that topographic point is a involve to tape a large sum of information along alongside your audit log entry... so, how should this involve hold upward handled?

FHIR offers an interesting solution. The Binary resource. That is to state you lot lay the large blob into a Binary, too accept the AuditEvent betoken at that Binary. There is an additional characteristic of Binary that is useful to position the safety that should hold upward applied to this Binary instance, the Binary.securityContext tin dismiss betoken at the AuditEvent instance.