Add audit logs for network operations and key usage

Open
#2,376 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
rust
Domain
cli, security

Research direction

Start by examining the existing stellar cache actionlog feature and how its records are stored and displayed. Define the network-operation and key-usage fields, storage location, replacement or migration path, and plain-text and JSON behavior before implementation. Done means successful and failed activity can be persisted and retrieved in the requested formats.

Written by the indexing model from the issue text.

Description

feature request
What problem does your feature solve?

When using the CLI over time, there's no persistent record of:

  1. Network operations - What on-chain operations were performed, on which network, and when
  2. Key usage - What a key has been used to sign, including transactions and auth invocations

This makes it difficult to:

  • Review what transactions were submitted from a machine
  • Track how keys are being used across different operations
  • Audit signing activity for security or compliance purposes
  • Troubleshoot issues ("did I already deploy this?" or "what did I sign with this key?")

Note: There is an existing action log feature at stellar cache actionlog which is essentially an audit log of rpc interactions, but it's not very ergonomic and doesn't surface information in a way that can be easily parsed. This proposal would likely replace the action log.

What would you like to see?

Add audit logs that track CLI activity. Two types of logs could be considered:

1. Network Operations Log

  • Timestamp
  • Network (testnet, mainnet, etc.)
  • Command executed (deploy, invoke, etc.)
  • Send vs Simulation
  • Transaction hash (if successful)
  • Contract ID (if applicable)
  • Success/failure status

2. Key Usage Log

  • Timestamp
  • Key identifier (public key or alias)
  • Operation type (transaction signing, auth invocation signing)
  • Transaction hash or context
  • Network
  • What was being authorized (contract, function, etc.)

The audit logs could be stored in a standard location (e.g., ~/.config/stellar/audit/) and support displaying in different output formats (plain text, JSON) for easy parsing.

What alternatives are there?
  • Status quo: Users manually track operations or rely on shell history
  • External tooling: Use shell wrappers or scripts to log commands
  • Block explorer: Look up account history on-chain (doesn't capture failed attempts, local context, or which local key was used)

Related: #2375 (confirmation prompts for mainnet operations)

Dominant language
Rust
Stars
123
Forks
141
Avg merge
2d 21h
Merged PRs (30d)
17

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stellar/stellar-cli

All issues in stellar/stellar-cli

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.