An audit log answers legal and forensic questions, not debugging ones. Each record names an actor, an action, a resource, an outcome, a request id, a source address and a UTC timestamp. It is append-only and ideally kept off the machine that writes it.