Fort Audit - Atomic audit logging for Elixir/Phoenix

Hey guys, I’ve had this in local for a couple of days I thought I should share to the community.

What if ? A business transaction can never be reported as complete ({:ok, _}) unless its audit trail is also complete, written atomically with it.

FortAudit aims to solve this but not entirely confined by this business rule, it is an audit logging library that dual-routes every audit event to PostgreSQL (via Ecto.Multi) and structured JSON (via Elixir’s :logger). Business transactions and their audit records are always committed atomically.

Two paths

• Transactional transact/4: DB audit row is atomic with business steps. Logger emission is secondary, after commit.

• Standalone log/1: Single insert outside a transaction. Useful for pre-Multi validation failures or non-transactional code.

When you need AduitFort

• You need both audit trail AND ops visibility: the DB row is your source of truth for compliance; the Logger line is how your on-call finds the event in Datadog/Loki without running a SQL query.

• Your audit is part of a business transaction: the order was created, the payment was captured, and the audit row must commit atomically with both. A separate Repo.insert after Repo.transaction returns leaves a window where the business data exists but the audit doesn’t.

• You can’t afford silent audit loss: a crash between the DB commit and the Logger emission leaves a row with emitted_at: nil. FortAudit’s reconciliation finds those rows and re-emits them on restart.

• You ship logs to a metrics-oriented backend: Loki, Datadog, and Elasticsearch all charge by label cardinality. FortAudit’s configurable label/body split keeps unbounded fields out of your indexed metadata by default.

Key features

• Atomic by construction: bare Ecto.Multi passed to transact/4 raises; you must wrap with Fort.Audit.wrap/1 first. Zero-step transactions also raise. The type system prevents silent omissions.

• At-least-once Logger emission: the DB write commits first. If the process crashes before the Logger line is emitted and emitted_at stamped, the row is recovered on restart via mix fort.reconcile.

• Label-safe metadata: Logger metadata is split into two tiers via :logger_label_fields config. Low-cardinality fields are top-level keys; unbounded fields nest under a single :details key, preventing accidental label explosions in Loki/Datadog/Elasticsearch.

• No vendor lock-in: FortAudit’s responsibility ends at emitting a well-structured Logger line.

• Pure Ecto: Zero dependencies on Phoenix, Plug, or any web framework.

Quick start

# mix.exs
{:fort_audit, "~> 0.1"}

# config/config.exs
config :fort_audit, :repo, MyApp.Repo

mix fort.install
mix ecto.migrate

Multi.new()
|> Multi.insert(:user, user_changeset)
|> Fort.Audit.wrap()
|> Fort.Audit.append_to_multi(:audit, %{
  actor_id: actor.id,
  actor_type: "admin_user",
  action: "user.created"
})
|> Fort.Audit.transact("user.created", actor.id)

Recover unemitted rows:

mix fort.reconcile

GitHub:

Hex: