Bibliotecas de auditoria em Java: avaliação do cenário atual e proposta de uma nova solução

Abstract

Audit logs are an essential requirement in contemporary software systems, fundamental to ensuring security, traceability, and compliance with regulations. However, a critical analysis of auditing solutions for Java applications reveals a limitation: most libraries focus on the persistence layer, failing to capture relevant events from the business layer (even those not related to the database) and sometimes presenting inflexibility in log writing mechanisms or a high impact on performance. Given this scenario, this work aimed to evaluate current audit solutions in Java applications, identify their limitations, and propose a new approach. For this, a comparative analysis of the Spring Data Envers, JaVers, Logbook, and Audit4j tools was carried out in a demonstration application, considering implementation complexity, data volume, and performance. Subsequently, a new library was developed with custom annotations, Aspect-Oriented Programming, and asynchronous processing, based on the Open/Closed Principle to be extensible. As a result, the proposed library allows the developer to easily integrate an audit that logs data in MongoDB or SLF4J, with the possibility of extending interfaces to customize the writing of logs, obtaining the author of the action, and others. The evaluation carried out demonstrated that the proposed approach captures much more comprehensive contextual information than solutions like Spring Data Envers, while maintaining a similar performance impact. It is concluded that the work offers a flexible and low-coupling alternative for implementing auditing in any method or service of the application.