Weave Code
Audit Logger Laravel Package
minvws/audit-logger
A Laravel audit logging package that records user actions and model events into a queryable audit trail. Easily log authentication attempts, CRUD changes, and custom entries with configurable storage and a clean API for reviewing activity.
minvws/audit-logger provides a structured, Laravel-native way to record security-relevant activity across your application. It helps teams build auditable trails for model changes, authentication events, and custom domain actions, with configurable context such as actor, subject, and request metadata.
- Laravel integration via service provider, configuration, and publishable migrations
- Automatic model auditing for created, updated, and deleted records
- Custom audit events with flexible metadata and actor attribution
- Configurable storage for persisting and querying audit records
- Extensible design for tailoring events and output to compliance needs
Frequently asked questions about Audit Logger
- How do I install minvws/audit-logger in a Laravel application?
- Install it with Composer using composer require minvws/audit-logger, then publish any package configuration and confirm whether the service provider is auto-discovered. Before committing, inspect composer.json for PHP and Laravel framework constraints and run a throwaway proof of concept. Do not treat the README alone as the integration contract; verify the service provider, config surface, and storage drivers against the code.
- Which Laravel and PHP versions does minvws/audit-logger support?
- Do not assume Laravel 11 or PHP 8.3 support from the release date alone. Check the package composer.json for explicit framework and PHP constraints, then test your target combination in a small proof of concept. Pin exact versions in your lock file and read the changelog before upgrading.
- Where can minvws/audit-logger write audit events?
- The package overview says it can log events to the database, syslog, or other destinations, so confirm the available drivers in the code and configuration. For production, plan to ship audit data to an immutable or SIEM sink rather than leaving it only in the application database. Validate the storage behavior and schema before broad instrumentation.
- Is minvws/audit-logger a replacement for Laravel's Log facade?
- No. It is positioned as a compliance-oriented audit logger, not a general application logger, so it should not be treated as a drop-in replacement for Log::info(). Use it for attributable audit trails such as privileged actions, record mutations, data access, and export events, and assign ownership to security, privacy, and legal stakeholders.
- Does minvws/audit-logger provide tamper-evident or append-only audit logs?
- This is a key question to verify in the code and configuration rather than assume. Look for hash chaining, signed batches, WORM storage, or other tamper-evident guarantees, and confirm how retention and deletion are handled. If those controls are missing, ship events to an immutable external sink before production traffic.
- What happens if an audit write fails—is minvws/audit-logger fail-open or fail-closed?
- Verify the failure behavior in the code and determine whether it is configurable. For privileged or regulated actions, a fail-open audit logger can create false assurance, so test write failures explicitly. Prefer fail-closed behavior where compliance requires that an action not proceed without an audit record.
- How does minvws/audit-logger handle PII and redaction?
- Confirm PII minimization guarantees in the implementation, such as actor ID hashing, field allowlists, and redaction rules. An audit logger that writes personal data into the wrong fields can create compliance exposure. Define which fields are auditable and validate the resulting event schema with privacy and security owners.
- Can I use minvws/audit-logger outside Laravel or in non-Laravel PHP?
- The repository name nl-rdo-php-audit-logger suggests the underlying logger may be usable in non-Laravel PHP, but confirm that in the code before relying on it. The Laravel-native path is expected to be Composer installation, config publishing, and service provider registration. Non-Laravel support would reduce coupling if you later split services.
- How should I test minvws/audit-logger before production?
- Run a proof of concept in one bounded context, such as an admin panel or data-export endpoint, behind a feature flag. Write in parallel to your existing logging so you can compare coverage and validate the event schema. Instrument incrementally with middleware, Eloquent observers, and explicit calls for business-critical actions before attempting broad auto-instrumentation.
- Is minvws/audit-logger production-ready and well maintained?
- Community evidence is thin: the package has very low stars and no dependents, which is a bus-factor warning. Pin exact versions, read the changelog, and confirm the support model, release cadence, and security disclosure policy. The license is EUPL-1.2, a weak copyleft license, so get legal confirmation for redistribution, SaaS exposure, or forking.
Weaver
How can I help you explore Laravel packages today?