# What Is Audit Logging in Dewy? Deployment Tracking Explained

> Discover audit logging in Dewy, a powerful feature that automatically records deployment metadata like host, command, and timestamp. Understand your deployments with immutable text files stored in the registry.

- Repository: [Tomohisa Oda/dewy](https://github.com/linyows/dewy)
- Tags: deep-dive
- Published: 2026-03-06

---

**Audit logging in Dewy is a built-in mechanism that automatically records deployment metadata—host, command, and timestamp—as immutable text files stored alongside your artifacts in the registry.**

Dewy is an open-source deployment automation tool that simplifies shipping binaries and assets to production servers. Understanding **audit logging in Dewy** is essential for teams that require deployment visibility, compliance trails, or operational debugging without relying on external logging infrastructure.

## How Dewy Implements Audit Logging

After every successful deployment, Dewy generates a concise audit entry that captures exactly what happened. The implementation centers on the `Report` method in [`registry/ghr.go`](https://github.com/linyows/dewy/blob/main/registry/ghr.go), which constructs a human-readable string containing the hostname, the executed command, and the current UTC timestamp.

```go
// registry/ghr.go – Report method
info := fmt.Sprintf("shipped to %s %s at %s",
    strings.ToLower(hostname), req.Command, now)

```

This string is then uploaded as a plain-text release asset to the same registry hosting your artifact.

### The ReportRequest Struct

The `Report` method receives deployment context through the `ReportRequest` struct defined in [`registry/registry.go`](https://github.com/linyows/dewy/blob/main/registry/registry.go). This struct carries the command type—such as `server` or `assets`—and any error states that might need to be recorded alongside the audit entry.

## Where Audit Logs Are Stored

Dewy stores audit logs directly within your artifact registry, ensuring the deployment record travels with the binary it describes.

### GitHub Releases Storage

When using GitHub releases as your registry (`ghr://`), Dewy uploads the audit entry as a release asset attached to the specific version. The filename follows a predictable pattern:

```

shipped_to_{hostname}_{command}_at_{timestamp}.txt

```

For example: [`shipped_to_myhost_server_at_20240101T123456Z.txt`](https://github.com/linyows/dewy/blob/main/shipped_to_myhost_server_at_20240101T123456Z.txt).

### S3, GCS, and OCI Registries

For alternative storage backends—such as Amazon S3, Google Cloud Storage, or OCI-compliant registries—Dewy applies the same pattern. The audit text file is written adjacent to the deployed artifact, maintaining a consistent audit trail regardless of where your artifacts live.

## Accessing and Using Audit Logs

Because audit files are standard release assets, you can access them through the registry's native interface or programmatically via API.

### Deploy and Auto-Generate Logs

Run a standard Dewy deployment to automatically create the audit record:

```bash
dewy server \
    --registry ghr://myorg/myapp \
    --port 8080 \
    -- ./current/myapp

```

After the binary starts, Dewy uploads a file such as [`shipped_to_host_server_at_20240306T152300Z.txt`](https://github.com/linyows/dewy/blob/main/shipped_to_host_server_at_20240306T152300Z.txt) to the GitHub release assets.

### View Logs on GitHub

Navigate to your release page to download the audit file:

```bash
open "https://github.com/myorg/myapp/releases/tag/v1.2.3"

```

Look for the text file matching the `shipped_to_*` pattern in the assets list.

### Programmatically Fetch Audit Entries

External monitoring systems can retrieve audit logs directly from object storage:

```go
package main

import (
	"io/ioutil"
	"log"
	"net/http"
)

func main() {
	url := "https://my-bucket.s3.amazonaws.com/v1.2.3/shipped_to_host_server_at_20240306T152300Z.txt"
	resp, err := http.Get(url)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()
	body, _ := ioutil.ReadAll(resp.Body)
	log.Printf("Audit entry: %s", string(body))
}

```

This pattern allows you to integrate Dewy's audit trail into existing compliance dashboards or alerting systems.

## Why Audit Logging Matters in Dewy

Audit logging provides critical operational benefits without adding complexity:

- **Immutable records** – Once uploaded as a release asset, the audit file cannot be altered, providing a trustworthy history of every deployment.
- **Zero external dependencies** – Unlike centralized logging platforms, Dewy's audit records live in your existing artifact registry, eliminating additional infrastructure costs.
- **Compliance support** – The automatic timestamp and hostname capture satisfy common requirements for tracking who deployed what and when.
- **Notification integration** – Dewy's notification system can reference these audit entries when alerting on deployment failures or unexpected behavior.

## Summary

- **Audit logging in Dewy** creates a text record of every deployment containing the host, command, and UTC timestamp.
- The `Report` method in [`registry/ghr.go`](https://github.com/linyows/dewy/blob/main/registry/ghr.go) generates these entries, while [`registry/registry.go`](https://github.com/linyows/dewy/blob/main/registry/registry.go) defines the request structure.
- Audit files follow the naming convention `shipped_to_{host}_{command}_{timestamp}.txt`.
- Logs are stored as release assets in GitHub or as adjacent files in S3/GCS/OCI registries.
- This built-in mechanism provides immutable deployment history without requiring external logging services.

## Frequently Asked Questions

### What information does a Dewy audit log contain?

Each audit log entry contains the target hostname, the Dewy command that was executed (such as `server` or `assets`), and a UTC timestamp formatted as `shipped to {hostname} {command} at {timestamp}`. This plain-text format ensures human readability while remaining machine-parseable.

### Where are audit logs stored in Dewy?

According to the [`registry/ghr.go`](https://github.com/linyows/dewy/blob/main/registry/ghr.go) implementation, audit logs are stored as release assets within the same registry that hosts your deployed artifacts. For GitHub releases, this means the text file appears in the release's asset list; for S3 or GCS, it resides in the same bucket prefix as the binary.

### Does Dewy support audit logging for all registry types?

Yes. While the primary implementation resides in [`registry/ghr.go`](https://github.com/linyows/dewy/blob/main/registry/ghr.go) for GitHub releases, Dewy applies the same audit file pattern across all supported backends—including S3, Google Cloud Storage, and OCI registries—ensuring consistent deployment tracking regardless of storage provider.

### How can I retrieve audit logs for a specific deployment?

Navigate to the specific release version in your registry (e.g., `https://github.com/owner/repo/releases/tag/v1.0.0`) and locate the text file matching the `shipped_to_*` pattern. Alternatively, use your storage provider's API or SDK to list assets for that version and filter by the audit file prefix.