← Back to docs

Three streams · when to use Audit trails vs Syslog vs API access

Every fasten SDK ships three structured streams threaded by one request_id. They are not interchangeable. This page is the decision table and the tradeoffs so you write each event to the right stream the first time.

Audience. Engineers instrumenting a service and choosing between emit(), log.info(), or the API middleware for a given event.

Decision table

The event is…UseWhy
A typed decision the system commits to (payment captured, belief updated, permission granted)Audit trailsDurable, hash-chained, defensible to a regulator.
A structured event a human wants to see when debugging (drainer backpressure, retry attempt, cache miss)SyslogStructured but ring-buffered by default; opt-in persistence for durability without the audit-row overhead.
An inbound or outbound HTTP call (route, method, status, duration)API accessStamped by the transport shim automatically; correlates the wire with everything downstream.
A metric ("count of X in the last minute")Nonefasten is not a metrics store. Use your existing metrics pipeline.
A distributed trace spanNonefasten is not a tracer. Emit the span to your trace vendor and let fasten thread request_id through it.

Per-stream tradeoffs

Audit trails

Syslog

API access

Correlation at read time

The /logs/correlate endpoint fans out to all three streams for one request_id and returns a unified view.

GET /logs/correlate?request_id=req_01H9F2K7ZZ

The response has audit[], api[], and sys[] arrays, plus per-stream counts, totals, truncated, and completeness (ring, store, or store-degraded) so the caller knows whether the returned rows are the full picture or a truncated window. See the auditor's runbook for the completeness contract.

Warning cases

PII in Syslog with medium retention. Syslog is structured but not schema-enforced. If you write PII into a Syslog event and enable persistence, the retention setting alone doesn't scrub it. Use FASTEN_REDACT_KEYS and treat any Syslog event carrying user data as requiring the SHORT retention.

Do not put decisions in Syslog to save cost. A "user X approved by manager Y" event belongs in Audit trails (hash-chained, defensible). Putting it in Syslog makes it a debug log entry, not audit evidence. The cost delta is small; the defensibility delta is total.

Rings can silently drop. A ring-only stream reports completeness: ring, meaning rows can be lost during a burst that exceeds ring size, never that they were. If you need the row to survive a burst, persist the stream.

fasten

The audit substrate for distributed systems, and the belief layer for the AI agents on top of them.

Products
fastenmembranefasten fleet
Resources
DocsHow It WorksWhy fastenContact
© 2026 fasten · nerdAppLabs Software Solutions Pvt. Ltd.SDK Apache-2.0 · membrane & fleet commercial