- How does Yammi handle audit logging for Laravel jobs and queue workers?
- Yammi automatically captures the full execution chain by propagating a correlation ID through jobs, allowing you to trace who triggered a write and through what chain (e.g., HTTP request → Job → Job → Model). Ensure your job payloads include the `correlation_id` for accurate tracing across workers. Async writes (via `AUDIT_LOG_WRITE_ASYNC=true`) further decouple logging from business logic.
- Can Yammi audit non-Eloquent database changes (e.g., raw SQL or Query Builder updates)?
- No, Yammi relies on Eloquent events by default. For raw SQL or Query Builder updates, you must manually call `AuditLog::record()` with the model, changes, and actor details. This is a deliberate design choice to ensure consistency in tracking provenance. Consider using a trait or middleware to automate this for critical non-Eloquent writes.
- What Laravel and PHP versions does Yammi support?
- Yammi is compatible with Laravel 9–13 and PHP 8.1+. The package is regularly updated to align with Laravel’s supported versions, and the README includes tested PHP versions (8.1, 8.2, 8.3). No breaking changes are expected for minor Laravel updates within this range.
- How does Yammi ensure data integrity and prevent tampering with audit logs?
- Yammi uses a tamper-evident hash chain to detect alterations in audit logs. Each log entry includes a cryptographic hash of the previous entry, creating a chain that breaks if any record is modified. You can verify log integrity with the `audit-log:verify` command. This feature is critical for compliance and forensic investigations.
- Is the Yammi dashboard required, and how does it impact performance?
- The dashboard is optional and can be disabled entirely with `php artisan audit-log:ui disable`. When enabled, it adds minimal overhead (~1–2ms per request) and is rate-limited to avoid performance bottlenecks. The UI is built with Vue.js and served as a single-page app, so it doesn’t impact database performance during business operations.
- How can I configure Yammi to ignore high-churn models (e.g., logs, cache entries)?
- Use the `AUDIT_LOG_SAMPLE_RATE` config to define a percentage of changes to log for specific models. For example, set `AUDIT_LOG_SAMPLE_RATE` to `0.1` to log only 10% of changes for a model like `LogEntry`. This reduces storage overhead and query performance impact without sacrificing critical audit coverage.
- Does Yammi support multi-tenancy, and how do I configure tenant-aware auditing?
- Yes, Yammi includes built-in support for multi-tenancy via middleware or model binding. Configure the `tenant_key` in the `config/audit-log.php` file to specify which column (e.g., `tenant_id`) should be used for tenant isolation. This ensures audit logs are automatically segmented by tenant without manual intervention.
- How do I generate GDPR subject-access reports with Yammi?
- Yammi provides a `audit-log:export` command to generate GDPR-compliant reports, including subject-access requests. You can filter logs by user, date range, or model using the CLI or dashboard. The exported data includes redacted sensitive fields (e.g., passwords, API keys) by default, configurable via the `redact_fields` setting.
- Can Yammi integrate with Slack or other webhook alerts for anomalies?
- Yes, Yammi supports Slack and custom webhook alerts for anomalies or critical changes. Configure the `webhook_url` and `slack_webhook_url` in the `config/audit-log.php` file. You can also set up anomaly detection rules (e.g., rapid-fire updates to sensitive models) to trigger alerts automatically.
- What are the alternatives to Yammi, and when should I consider them?
- Alternatives like Spatie’s `laravel-audit-log` focus on basic change tracking without provenance chains or queue/job support. Use Yammi if you need distributed tracing (e.g., HTTP → Job → Model), tamper-evidence, or GDPR reports. For simpler needs, Spatie’s package may suffice, but it lacks Yammi’s execution chain reconstruction and async write optimizations.