When something goes wrong in a system, a breach, an error, a disputed transaction, the first question is always the same: who did what, and when? Audit logging answers it, and the value of the answer depends entirely on whether the record can be trusted, which is why immutability matters as much as the logging itself.
An audit log records significant events in a system: logins, data access, changes to records, permission changes, administrative actions. Good logging captures enough context, who, what, when, and from where, to reconstruct what happened. This serves security, by making intrusions and misuse detectable, and compliance, by proving the system behaved as it should.
A log that can be quietly edited is a log that cannot be trusted, because the very person who did something wrong could erase the evidence. Immutable, or tamper-evident, logging ensures records cannot be altered or deleted after the fact without detection. In regulated contexts, this is often not optional; an examiner needs assurance that the trail reflects reality, not a cleaned-up version.
Logs only help if someone watches them. Mature systems pair immutable logging with monitoring and alerting, so suspicious patterns surface quickly rather than being discovered months later. And retention policies keep logs long enough to satisfy regulations and investigations. The trail is only useful if it is complete, trustworthy, and actually reviewed.
A record no one can quietly rewrite.
This is general educational information, not specific security, compliance, or legal advice for your systems.