How would you design an audit logging system for enterprise-grade Node.js applications?

An enterprise-grade Node.js audit logging system should capture immutable, structured records of security- and business-relevant events, separate audit concerns from application logging, and provide reliable storage, querying, retention, and compliance controls. The design should use asynchronous pipelines, tamper resistance, contextual metadata, and clear event schemas while avoiding performance impact on request handling.

An audit logging system is a security and compliance subsystem that records who did what, when, where, and under what conditions. It is different from application logs: application logs help engineers debug failures, while audit logs provide an authoritative history of actions that may affect security, data integrity, or business operations.

A strong enterprise design usually has these layers:…