velobuff · March 9, 2016 21:51 · Feb 26, 2016 · Feb 26, 2016 · Feb 26, 2016 · Feb 26, 2016
diff --git a/README.md b/README.md
@@ -1,3 +1,5 @@
+# Adding an audit log to your Rails app
+
 If you have any sort of administrative interface on your web site, you can easily imagine an intruder gaining access and mucking about. How do you know the extent of the damage? Adding an audit log to your app is one quick solution. An audit log should record a few things:
 
 - controller entry points with parameter values

diff --git a/README.md b/README.md
@@ -0,0 +1,7 @@
+If you have any sort of administrative interface on your web site, you can easily imagine an intruder gaining access and mucking about. How do you know the extent of the damage? Adding an audit log to your app is one quick solution. An audit log should record a few things:
+
+- controller entry points with parameter values
+- permanent information about the user, like user_id
+- transient information about the user, like IP and user_agent
+
+Using the Rails framework, this is as simple as adding a `before_action` to your admin controllers. Here’s a basic version that I’m using in production.
diff --git a/admin_controller.rb b/admin_controller.rb
@@ -0,0 +1,6 @@
+require 'audit_log'
+
+class AdminController < ApplicationController
+  include AuditLog
+  before_action :auto_log
+end
diff --git a/audit_log.rb b/audit_log.rb
@@ -0,0 +1,25 @@
+require 'geoip'
+
+module AuditLog
+  def geoip
+    @@geoip ||= GeoIP.new(File.join(Rails.root, '/lib/GeoIPCity.dat'))
+  end
+
+  def auto_log
+    rails_action = "#{ params[:controller] }##{ params[:action] }"
+    rails_params = params.except(:controller, :action)
+
+    details = {
+      :logger => 'AuditLog',
+      :action => rails_action,
+      :ip_address => request.remote_ip,
+      :geo_ip => geoip.city(request.remote_ip).to_h,
+      :user_id => current_user&.id,
+      :user_email => current_user&.email,
+      :user_name =>  current_user&.name,
+      :params => rails_params,
+      :user_agent => request.user_agent
+    }
+    Rails.logger.info MultiJson.dump(details)
+  end
+end