Product Decisions This Supports
- Regulatory Compliance & GDPR: Enables automated generation of GDPR subject access reports, retention policies, and tamper-evident audit trails for legal audits. Justifies investment in compliance-heavy industries (finance, healthcare).
- Incident Response & Root Cause Analysis: Solves the "who really did this?" problem in distributed systems (e.g., a user’s payment fails due to a queued job modifying their order). Critical for SaaS platforms with multi-tenant workflows.
- Build vs. Buy: Replaces custom audit-logging logic or third-party tools (e.g., Splunk, Datadog) for Laravel-specific needs, reducing vendor lock-in and operational overhead.
- Observability for Complex Workflows: Tracks execution chains across jobs, commands, and schedulers—ideal for platforms with asynchronous pipelines (e.g., e-commerce, SaaS with background processing).
- Multi-Tenancy & Shared Hosting: Isolates audit logs per tenant with built-in multi-tenancy support, addressing security and compliance concerns in shared environments.
- Time-Machine Debugging: Enables "undo" or "as-of" queries for critical data (e.g., reverting a user’s account to a previous state pre-incident).
- Anomaly Detection & Alerts: Proactively flags suspicious activity (e.g., mass updates, unauthorized changes) via Slack/webhooks, reducing manual monitoring.
- Performance Optimization: Offers async writes and batching to minimize impact on production traffic, critical for high-throughput apps.
When to Consider This Package
Adopt if:
- Your Laravel app relies heavily on queues/jobs (e.g., background processing, event-driven workflows).
- You need end-to-end traceability of changes—from user action to final database write—across distributed components.
- Regulatory requirements demand immutable audit logs (e.g., GDPR, SOX, HIPAA) with tamper-evidence.
- You’re debugging incidents in production where traditional audit logs fail to show the full chain (e.g., "Why did this order status change?").
- Your team lacks time to build/maintain a custom audit solution with provenance tracking.
- You use multi-tenancy and need tenant-isolated audit logs without per-model setup.
Look elsewhere if:
- Your app is simple CRUD with no queues/jobs—traditional packages (e.g.,
spatie/laravel-activitylog) may suffice.
- You need real-time analytics or search (this package defers to SIEM/Elastic; see Non-goals).
- Your stack is non-Laravel (PHP but not Eloquent-based).
- You require event sourcing or state replay (this is forensic-only).
- Your budget allows for dedicated observability tools (e.g., Datadog, Honeycomb) for distributed tracing.
How to Pitch It (Stakeholders)
For Executives:
"This package turns Laravel’s audit logs from a basic ‘what changed’ tracker into a forensic-grade time machine for our distributed system. Imagine being able to answer ‘Who really triggered this critical change, and through what chain?’ in seconds—even if it happened across queues, jobs, or schedulers. It’s like adding GDPR compliance, incident response, and workflow debugging with a single, lightweight integration. No per-model setup, no performance hit, and it plays nice with our existing stack. For $0 in dev effort, we gain regulatory safety, faster debugging, and multi-tenancy isolation—critical for [industry/compliance goals]."
For Engineers:
*"Yammi solves the provenance problem in Laravel: traditional audit logs lose the user context when changes flow through queues. This package records:
- Actor: Who executed the change (e.g.,
ChargeOrderJob).
- Origin: Who started it (e.g.,
John Doe—survives the queue).
- Correlation ID: Ties the whole cascade together for end-to-end tracing.
Key perks:
- Zero model setup: Just install, migrate, and it works globally.
- Async writes: No blocking on production traffic.
- Optional dashboard: Turn-key UI for investigations (disable by default).
- GDPR tools: Automated subject reports, retention, and multi-tenancy.
- Anomaly alerts: Slack/webhooks for suspicious activity.
Trade-offs:
- Not a replacement for SIEM (defer search to Elastic/Splunk).
- Focuses on write-side traceability, not read-path profiling.
Use cases:
- Debugging payment failures: ‘Why did Order #42 change to
paid?’
- GDPR requests: ‘Show me all changes to User X in the last 90 days.’
- Multi-tenant security: ‘Who modified Tenant Y’s data?’
How to start:
composer require romalytar/yammi-audit-log-laravel
php artisan migrate
# Optional: php artisan audit-log:ui enable
Cost: Free (MIT license), ~500 LOC, minimal runtime overhead."*
For Security/Compliance:
*"This package future-proofs our audit logs for regulatory scrutiny by:
- Preserving origin across queues (critical for GDPR ‘right to erasure’).
- Tamper-evident hashing: SHA-256 chains verify no logs were altered.
- Automated GDPR reports: One command generates subject access logs.
- Multi-tenancy isolation: Audit logs are scoped to tenants by default.
No custom code needed—just enable it and start capturing. The dashboard (optional) gives us a single pane of glass for investigations, and alerts can notify us of anomalies in real time."*