1

Are there any Version Control Systems (VCS) that provide audit logs on whether a repository (or a particular file within the repo) has been read by a user?

I am referring to tools such as Github Enterprise and Azure DevOps. As far as I understand, neither of these provide audit logs about whether a repo has been viewed by a particular user, but rather on events such as push, pull, deletions, permission changes etc.

One particular instance where such audit logs might be necessary: in data science work storing/sharing notebooks containing results from sensitive data.

1 Answer 1

1

While I cannot recommend a specific software, I will try to explain why you are unlikely to find one, and propose an alternative.

Why per-file auditing is impractical in a modern VCS

An audit log for individual files is unlikely to be practical in a VCS, because with most VCS, users will typically download a complete repository (i.e. all files) for local use. This is because most VCS are designed for software development, where typically all (or most) files in a repository are required to build/run the software.

In particular, in distributed VCS (DVCS, such as Mercurial, or Git), not only will all files be downloaded, but also the complete history (that's the "distributed" part).

So in other words:

Per-file audit logs are impractical, because typical workflows (downloading/cloning) involve reading every single file.

Alternative - separate repositories

There is however an obvious alternative - using multiple repositories. In modern VCS, particularly in DVCS, access control usually happens per repository (or occasionally per branch). So any "restricted" or "private" files should be put into separate repositories.

That may sound complicated, but DVCS generally encourage and are designed for small, focused repositories. So just group your files by the level of privacy or auditing required, put them into separate repos and assign rights accordingly.

Or maybe a DMS?

Finally, if you are using the VCS as a sort of "document management system", i.e. for many files that are only loosely related (instead of files forming a single project), you may be better off actually using a truedocument management system, such as Alfresco.

5
  • Thanks! I agree on per-file logs being impractical. Would your answer change if we dropped the per-file requirement and focused on repo-level? That is, are there VCSs that audit user accessing (just viewing, not pulling/pushing etc.) the repo? For example, viewing the repo content in web browser?
    – vvv
    Commented Mar 31, 2022 at 13:39
  • @vvv: No, I don't know about any VCSs that does that. It's similar as with file-level auditing: Git for example will in many configurations automatically fetch all branches, so even branch-level auditing is not practical. I feel you are really shoehorning document management into a VCS. Consider using a dedicated document management system, which may support these things.
    – sleske
    Commented Apr 1, 2022 at 6:20
  • My use cases are projects where a repo contains both source code and explorative notebooks (in some cases I prefer not to separate the two into different repos). I need typical VCS properties (branching, viewing diffs in code etc.). In addition, since the notebooks may contain pieces of data requiring certain auditing principles, the need for view logs arises — even beyond restricting repo access to certain users (an overkill IMO, but I don't write the rules)! One might consider auditing views redundant (even I do), but I fail to see why logging repo access would be that impractical.
    – vvv
    Commented Apr 1, 2022 at 7:06
  • Anyway, thanks for the DMS suggestion, I will look into it! I am not too familiar with such tools in beforehand. If they support e.g. command line interfacing with Git and branching, then they could indeed provide an alternative. If not, then it is not quite what I am looking for.
    – vvv
    Commented Apr 1, 2022 at 7:10
  • You're welcome. Consider accepting my answer (click check mark) if you feel it helped :-).
    – sleske
    Commented Apr 1, 2022 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.