Design an audit logging system
PremiumSecurity systemEasy
- Append only log
- Hash chain
- WORM storage
Quick answer
This security system interview question asks you to design an audit logging system. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design an audit logging system for a B2B SaaS app, like the audit log pages in the admin consoles of work tools. It records who did what, to which resource and when, and lets customers search and export it. The hard parts are never losing an event and proving that nobody, including our own admins, edited or deleted one.
Enterprise customers need these logs for security reviews, compliance audits such as SOC 2, and investigations. Every product service (billing, documents, user management, public API) must emit events, and one missing or edited event can fail a customer's audit.
What must an audit logging system do?
- Record events: Store actor, action, target resource, tenant, time, source IP, user agent, result and request ID for every security-relevant action.
- Tamper evidence: Anyone with the right key can verify that a range of events is complete and unchanged.
How well must it do it?
- Durability: Zero lost events once the action has committed.
- Integrity: Nobody, including our own database admins, can change or delete an event before its retention ends without it being detected.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- Append only log
- Hash chain
- WORM storage
- Outbox pattern
- Kafka
- Retention policy
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design an audit logging system and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Easy, so it suits engineers who are new to security system interviews. It is also a good warm-up before harder questions.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team