Implementing Audit Trail in an ASP.NET Core Application with Entity Framework Plus

7 minute read

Introduction

An audit trail is a chronological record of changes or activities performed in a system, providing a detailed history of events. In the context of software applications, including ASP.NET, an audit trail captures and logs various actions such as data modifications, user interactions, and system activities.

Why it is important? It helps organizations maintain a record of user activity within their systems, which can be used

To monitor user actions and detect suspicious activities
To track changes and identify the root cause of issues
To ensure compliance with regulatory requirements
Records changes to critical data elements, ensuring accuracy and consistency
Provides a detailed history of events for forensic analysis
Meets legal and regulatory requirements by maintaining a detailed audit trail
Offers historical data for reporting and analysis, supporting decision-making
Frud detection etc.

In this article, we will discuss how you can implement an audit trail feature using Entity Framework plus

Tools and Technology Used

ASP.net core Web API
Visual C#
Entity Framework Plus
Entity Framework
SQL Server

Step 1: Create a asp.net core web api project name AuditLog.API

Step 2: Install the following nuget packages in the project.

Z.EntityFramework.Extensions.EFCore
Z.EntityFramework.Plus.EFCore
Microsoft.EntityFrameworkCore
Microsoft.EntityFrameworkCore.Design
Microsoft.EntityFrameworkCore.SqlServer
Microsoft.EntityFrameworkCore.Tools

Step 3: Create three Model class name Customer, CustomAuditEntry, CustomAuditEntryProperty in Models folder.

Customer class to store Customer Information
CustomAuditEntry class to store Audit Entry Information
CustomAuditEntryProperty class to store Audit Entry Property Information - means each properties new and old values

Customer.cs

  namespace AuditLog.API.Models
{
    public class Customer
    {
        public int Id { get; set; }
        public string? FirstName { get; set; }
        public string? LastName { get; set; }
    }
}

CustomAuditEntry.cs

using Z.EntityFramework.Plus;

namespace AuditLog.API.Models
{
    // CustomAuditEntry is a custom class that inherits from AuditEntry
    // It is used to add additional properties to the AuditEntry class
    public class CustomAuditEntry : AuditEntry
    {
        // ApplicationName is a custom property that will be added to the AuditEntry table for storing the application name
        public string AppplicationName { get; set; }
    }
}

CustomAuditEntryProperty.cs

using Z.EntityFramework.Plus;

namespace AuditLog.API.Models
{
    public class CustomAuditEntryProperty : AuditEntryProperty
    {
        // ApplicationName is a custom property that will be added to the AuditEntryProperty table
        // for storing the application name
        public string AppplicationName { get; set; }
    }
}

Step 4: Create a Context class name AuditLogDBContext in Persistence folder.

AuditLogDBContext.cs

using AuditLog.API.Models;
using Microsoft.EntityFrameworkCore;
using Z.EntityFramework.Plus;

namespace AuditLog.API.Persistence
{
    public class AuditLogDBContext : DbContext
    {
        // AuditEntries and AuditEntryProperties are the tables that will be used to store the audit logs
        public DbSet<CustomAuditEntry> AuditEntries { get; set; }
        public DbSet<CustomAuditEntryProperty> AuditEntryProperties { get; set; }

        // Customers is the table that will be used to store the customer data
        public DbSet<Customer> Customers { get; set; }

        // AuditLogDBContext is the constructor that will be used to configure the audit log tables
        public AuditLogDBContext(DbContextOptions<AuditLogDBContext> options) : base(options)
        {
            // AutoSavePreAction is a delegate that will be used to save the audit logs to the database
            // It configures a pre-action to execute before the SaveChanges method is executed
            AuditManager.DefaultConfiguration.AutoSavePreAction = (context, audit) =>
            {
                ((AuditLogDBContext)context).AuditEntries.AddRange(audit.Entries.Cast<CustomAuditEntry>());
            };
        }


    }
}

Step 5: Add connection string in appsettings.json file

appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "ConnectionStrings": {
    "DefaultConnection": "Server=localhost;Database=AuditLogEFPlusDB;User Id=sa;Password=myPassword;TrustServerCertificate=True;"
  },
  "AllowedHosts": "*"
}

Step 6: Create two Interface ICustomerRepository and IReportingRepository in Repositories/Interfaces folder

ICustomerRepository.cs

using AuditLog.API.Models;

namespace AuditLog.API.Repositories.Interfaces
{
    public interface ICustomerRepository
    {
        Task<IEnumerable<Customer>> GetCustomers();
        Task<Customer> GetCustomer(int id);
        Task<Customer> AddCustomer(Customer customer);
        Task<Customer> UpdateCustomer(Customer customer);
        Task<Customer> DeleteCustomer(int id);
    }
}

IReportingRepository.cs

namespace AuditLog.API.Repositories.Interfaces
{
    public interface IReportingRepositry
    {
        // Get all the changes for a particular entity response using Dynamic type
        Task<IEnumerable<dynamic>> GetChangeLogDynamic(string EntityName);
    }
}

Step 7: Create two Repository class name CustomerRepository and ReportingRepository in Repositories/Implementations folder

CustomerRepository.cs

using AuditLog.API.Models;
using AuditLog.API.Persistence;
using AuditLog.API.Repositories.Interfaces;
using Microsoft.EntityFrameworkCore;
using Z.EntityFramework.Plus;

namespace AuditLog.API.Repositories.Implementations
{

    public class CustomerRepository : ICustomerRepository
    {
        private readonly AuditLogDBContext _context;

        public CustomerRepository(AuditLogDBContext context)
        {
            _context = context;
        }

        public async Task<IEnumerable<Customer>> GetCustomers()
        {
            return await _context.Customers.ToListAsync();
        }

        public async Task<Customer> GetCustomer(int id)
        {
            return await _context.Customers.FindAsync(id);
        }

        public async Task<Customer> AddCustomer(Customer customer)
        {
            // Used for audit log
            var audit = new Z.EntityFramework.Plus.Audit();
            audit.CreatedBy = "mahedee";

            _context.Customers.Add(customer);
            try
            {
                // SaveChangesAsync(audit) will commit the changes to the database and save the audit logs
                await _context.SaveChangesAsync(audit);
            }
            catch (DbUpdateException)
            {
                if (CustomerExists(customer.Id))
                {
                    return null;
                }
                else
                {
                    throw;
                }
            }

            return customer;
        }

        public async Task<Customer> UpdateCustomer(Customer customer)
        {
            var audit = new Z.EntityFramework.Plus.Audit();
            audit.CreatedBy = "mahedee";
            var customerToUpdate = await _context.Customers.FindAsync(customer.Id);
            _context.Entry(customerToUpdate).CurrentValues.SetValues(customer);

            try
            {
                // SaveChangesAsync(audit) will commit the changes to the database and save the audit logs
                await _context.SaveChangesAsync(audit);
            }
            catch (DbUpdateConcurrencyException)
            {
                if (!CustomerExists(customer.Id))
                {
                    return null;
                }
                else
                {
                    throw;
                }
            }
            return customer;
        }

        public async Task<Customer> DeleteCustomer(int id)
        {
            var audit = new Z.EntityFramework.Plus.Audit();
            audit.CreatedBy = "mahedee";

            var customer = await _context.Customers.FindAsync(id);
            if (customer == null)
            {
                return null;
            }

            try
            {
                _context.Customers.Remove(customer);
                await _context.SaveChangesAsync(audit);
            }
            catch (Exception)
            {
                throw;
            }

            return customer;
        }

        private bool CustomerExists(int id)
        {
            return _context.Customers.Any(e => e.Id == id);
        }
    }

}

ReportingRepository.cs

using AuditLog.API.Persistence;
using AuditLog.API.Repositories.Interfaces;
using Microsoft.EntityFrameworkCore;

namespace AuditLog.API.Repositories.Implementations
{
    public class ReportingRepository : IReportingRepositry
    {
        private readonly AuditLogDBContext _context;

        public ReportingRepository(AuditLogDBContext context)
        {
            _context = context;
        }

        public async Task<IEnumerable<dynamic>> GetChangeLogDynamic(string EntityName)
        {
            String EntityTypeName = EntityName;

            var result = _context.AuditEntries
            .Where(a => a.EntityTypeName == EntityTypeName)
            .Join(_context.AuditEntryProperties,
            entry => entry.AuditEntryID,
            property => property.AuditEntryID,
                (entry, property) => new
                {
                    AuditEntryId = entry.AuditEntryID,
                    EntityTypeName = entry.EntityTypeName,
                    State = entry.State,
                    StateName = entry.StateName,
                    PropertyName = property.PropertyName,
                    OldValue = property.OldValue,
                    NewValue = property.NewValue,
                    CreatedBy = entry.CreatedBy,
                    CreatedDate = entry.CreatedDate
                }
                                                                                       )
            .OrderBy(result => result.CreatedDate)
            .Select(result => new
            {
                result.AuditEntryId,
                result.EntityTypeName,
                result.State,
                result.StateName,
                result.PropertyName,
                result.OldValue,
                result.NewValue,
                result.CreatedBy,
                result.CreatedDate
            });

            return await result.ToListAsync();
        }
    }
}

Step 8: Create two interfaces name ICustomerService and IReportingService in Services/Interfaces folder

ICustomerService.cs

using AuditLog.API.Models;

namespace AuditLog.API.Services.Interfaces
{
    public interface ICustomerService
    {
        Task<IEnumerable<Customer>> GetCustomers();
        Task<Customer> GetCustomer(int id);
        Task<Customer> AddCustomer(Customer customer);
        Task<Customer> UpdateCustomer(Customer customer);
        Task<Customer> DeleteCustomer(int id);
    }
}

IReportingService.cs

namespace AuditLog.API.Services.Interfaces
{
    public interface IReportingService
    {
        
        // Get all the changes for a particular entity response using Dynamic type
        Task<IEnumerable<dynamic>> GetChangeLogDynamic(string EntityName);
    }
}

Step 9: Create 2 service class name CustomerService and ReportingService in Services/Implementation folder

CustomerService.cs

using AuditLog.API.Models;
using AuditLog.API.Repositories.Interfaces;
using AuditLog.API.Services.Interfaces;

namespace AuditLog.API.Services.Implementations
{
    public class CustomerService : ICustomerService
    {
        private readonly ICustomerRepository _customerRepository;

        public CustomerService(ICustomerRepository customerRepository)
        {
            _customerRepository = customerRepository;
        }

        public async Task<IEnumerable<Customer>> GetCustomers()
        {
            return await _customerRepository.GetCustomers();
        }

        public async Task<Customer> GetCustomer(int id)
        {
            return await _customerRepository.GetCustomer(id);
        }

        public async Task<Customer> AddCustomer(Customer customer)
        {
            var addedCustomer = await _customerRepository.AddCustomer(customer);
            return addedCustomer;
        }

        public async Task<Customer> UpdateCustomer(Customer customer)
        {
            var updatedCustomer = await _customerRepository.UpdateCustomer(customer);
            return updatedCustomer;
        }

        public async Task<Customer> DeleteCustomer(int id)
        {
            var deletedCustomer = await _customerRepository.DeleteCustomer(id);
            return deletedCustomer;
        }
    }
}

ReportingService.cs

using AuditLog.API.Repositories.Interfaces;
using AuditLog.API.Services.Interfaces;

namespace AuditLog.API.Services.Implementations
{
    public class ReportingService : IReportingService
    {
        private readonly IReportingRepositry _reportingRepositry;

        public ReportingService(IReportingRepositry reportingRepositry)
        {
            _reportingRepositry = reportingRepositry;
        }

        public async Task<IEnumerable<dynamic>> GetChangeLogDynamic(string EntityName)
        {
            return await _reportingRepositry.GetChangeLogDynamic(EntityName);
        }
    }
}

Step 10: Configure Program class as follows.

Program.cs

using AuditLog.API.Models;
using AuditLog.API.Persistence;
using AuditLog.API.Repositories.Implementations;
using AuditLog.API.Repositories.Interfaces;
using AuditLog.API.Services.Implementations;
using AuditLog.API.Services.Interfaces;
using Microsoft.EntityFrameworkCore;
using Z.EntityFramework.Plus;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();


builder.Services.AddDbContext<AuditLogDBContext>(options =>
    options.UseSqlServer(
        builder.Configuration.GetConnectionString("DefaultConnection"))
);


// For Audit Log

AuditManager.DefaultConfiguration
.AuditEntryFactory = args =>
   new CustomAuditEntry() { AppplicationName = "AuditLogApp" };

AuditManager.DefaultConfiguration
            .AuditEntryPropertyFactory = args =>
                new CustomAuditEntryProperty() { AppplicationName = "AuditLogApp" };

AuditManager.DefaultConfiguration.AutoSavePreAction = (context, audit) => {
    ((AuditLogDBContext)context).AuditEntries.AddRange(audit.Entries.Cast<CustomAuditEntry>());
};


string connectionString = builder.Configuration.GetConnectionString("DefaultConnection");
//builder.Services.AddTransient(_ => new DBConnector(connectionString));

builder.Services.AddTransient<ICustomerRepository, CustomerRepository>();
builder.Services.AddTransient<ICustomerService, CustomerService>();
builder.Services.AddTransient<IReportingRepositry, ReportingRepository>();
builder.Services.AddTransient<IReportingService, ReportingService>();


var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

app.UseAuthorization();

app.MapControllers();

app.Run();

Step 11: Create two Controller class CustomersController and ReportingController in Controllers folder.

CustomersController.cs

using AuditLog.API.Models;
using AuditLog.API.Services.Interfaces;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;

namespace AuditLog.API.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class CustomersController : ControllerBase
    {
        private readonly ICustomerService _customerService;

        public CustomersController(ICustomerService customerService)
        {
            _customerService = customerService;
        }

        // GET: api/Customers
        [HttpGet]
        public async Task<IEnumerable<Customer>> GetCustomers()
        {
            return await _customerService.GetCustomers();
        }

        // GET: api/Customers/5
        [HttpGet("{id}")]
        public async Task<Customer> GetCustomer(int id)
        {
            return await _customerService.GetCustomer(id);
        }

        // PUT: api/Customers/5
        [HttpPut("{id}")]
        public async Task<Customer?> PutCustomer(int id, Customer customer)
        {
            if (id != customer.Id)
            {
               return null;
            }
            try
            {
                return await _customerService.UpdateCustomer(customer);
            }
            catch (DbUpdateConcurrencyException)
            {
                if (!CustomerExists(id))
                {
                    return null;
                }
                else
                {
                    throw;
                }
            }
        }

        // POST: api/Customers
        [HttpPost]
        public async Task<ActionResult<Customer>> PostCustomer(Customer customer)
        {
            return await _customerService.AddCustomer(customer);
        }

        // DELETE: api/Customers/5
        [HttpDelete("{id}")]
        public async Task<Customer> DeleteCustomer(int id)
        {
            return await _customerService.DeleteCustomer(id);
        }

        private bool CustomerExists(int id)
        {
            return _customerService.GetCustomer(id) == null ? false : true;
        }
    }
}

ReportingController.cs

using AuditLog.API.Services.Interfaces;
using Microsoft.AspNetCore.Mvc;

namespace AuditLog.API.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class ReportingController : ControllerBase
    {
        private readonly IReportingService _reportingService;

        public ReportingController(IReportingService reportingService)
        {
            _reportingService = reportingService;
        }

        // GET: api/AuditTrailReport
        [HttpGet]
        public async Task<IActionResult> Index()
        {
            return NoContent();
        }

        // GET: api/AuditTrailReport/{EntityName}
        [HttpGet("GetChangeLog/{EntityName}")]
        public async Task<IActionResult> GetChangeLog(string EntityName)
        {
            return Ok(await _reportingService.GetChangeLogDynamic(EntityName));
        }
    }
}

Step 12: Create migration and update database

Open Package Manager Console (PMC).
Select the project name AuditLog.API
Run the following command in PMC

Add-Migration InitialCreate

This will create a new migration file named “InitialCreate” under the Migrations folder of your

Run the following command in PMC

Update-Database

You will see three table name Customers, AuditEntry, AuditEntryProperty are created in the database

Step 13: Run the application and check the swagger.

Now run application create, update and delete Customer entity using swagger
You will see audit trail logs in AuditEntry and AuditEntryProperty table.
You can also view a sample report using Reporting controller. In GetChangeLog end point use “Customer” as entity name.

Source code

Twitter Facebook LinkedIn

Mahedee Hasan

Implementing Audit Trail in an ASP.NET Core Application with Entity Framework Plus

You May Also Enjoy

Step-by-Step Guide: Deploying an ASP.NET Core Application with Azure Kubernetes Services, Azure SQL Server, and Azure Container Registry

Understanding Different Kinds of Kubernetes Resources

How to Configure SSL and HTTPS for RabbitMQ in Docker

Utilizing Bulk Operations with Entity Framework and ASP.NET Core