Symfony 2.7 Application audit trail - Best Practices

Question

I have a large multi-story Symfony2 application using doctrine and about 40-50 database tables in MySQL.

Does anyone have experience setting up an audit trail process to at least keep track of all Doctrine actions that create, edit, or delete data in a large application?

Ideally, this should “just happen” so that the other developer doesn't have to worry about making their new entities or “loggable” code.

I have no specific meeting requirements (HIPAA, etc.), but it would be nice to be as close to any ISO27000 best practices as I can be.

My inner plan is to look at using some Doctrine lifecycle callbacks to capture information and push it into a separate MySQL database without DELETE or UPDATE permissions. I am worried that this method can greatly affect performance.

Has anyone done this before or something similar that has any hints or warning words that I plan to use?

If this is important, the entire stack runs on AWS, and I can use any of my services in the EU-West-1 region. I already use things like RDS, Elasticache and SQS.

Thanks!

Answer 1

OroPlatform is built into Symfony 2.8 and has a package called OroDataAuditBundle that checks all operations on Doctrine objects (create, update, delete) at a deep level in just two tables: oro_audit and oro_audit_field .

And this is similar to the user interface:

You probably won't be able to use this package in your project - since it was created for OroPlatform - but you could at least get inspiration from your architecture.

If you want to test the operation of this audit system, they have an online demo at https://demo.orocrm.com . Just log in as an administrator and play around creating records, and then you can check all audit records at https://demo.orocrm.com/audit .