In a service mesh, where hundreds of services talk to each other every second, audit logs are not just records. They are the proof of what happened, who did it, and when. Without them, you are flying blind. With them, you can trace every request, detect policy violations, and meet compliance requirements without guesswork.
An audit logs service in a service mesh must handle more than raw throughput. It must capture fine-grained events at the data plane and control plane layers. Every security-sensitive action—TLS handshake failures, denied requests, policy changes—needs to be written immutably and queryable without delay. If your service mesh lacks this, you will not see the full story of your systems.
Service meshes like Istio, Linkerd, and Consul provide the networking foundation. But their native logging features often stop short of giving you a complete, centralized, and searchable audit trail. You need correlated logs across services, namespaces, and clusters. You need the ability to filter by user identity, request path, or policy rule. You need retention options that meet your regulatory obligations, whether that’s weeks or years.