Monitoring and backups
Logs and monitoring
Section titled “Logs and monitoring”| What | Where |
|---|---|
| Application log | writable/logs/ (CodeIgniter’s file handler); forward it to your log management or SIEM |
| Security events | audit log and application log (level warning, needs logger.threshold = 5): logins, failed logins, MFA, SSO, access.denied, rate limits, tenant switches, API and tenant administration, see Security events |
| Audit log integrity | php spark anvil:audit:verify daily; exit code 1 on tampering. Also export last_hash and entries of anvil_audit_chain regularly to a system outside the database, see Limits |
| API | access log anvil_api_access_log, see API |
| Jobs | exit codes of the scheduled commands, php spark queue:failed |
Worth alerting on: many auth.login_failed or access.denied from one
address, auth.mfa.* lockouts, any failed anvil:audit:verify, a stopped
queue worker, an unreachable virus scanner.
Backups
Section titled “Backups”| What | Note |
|---|---|
| Database | including anvil_audit_log and anvil_audit_chain |
writable/anvil/files/ |
uploads; database and files must be backed up together, anvil_files references them |
| Keys | encryption.key, encryption.previousKeys, anvil.auditKey and all anvil.auditPreviousKeys, separately from the database backup |
Exports (writable/anvil/exports/), cache, sessions and logs do not need
a backup for Anvil (logs may for your retention policy). Test the restore,
including php spark anvil:audit:verify on the restored database.