Audit and compliance solution guide: document all changes

Liquibase Secure provides a comprehensive change documentation solution that helps you document database changes for audit compliance. All executed changes are documented when you activate the DATABASECHANGELOGHISTORY table, Structured logging, and Observability reports. These tools give you the evidence you need to demonstrate compliance with change management requirements during audits.

Procedure

1

Enable the DATABASECHANGELOGHISTORY table.

Enable the DATABASECHANGELOGHISTORY parameter to record a history of all database changes. The DBCLH table can help developers and DevOps engineers easily see:

  • Which changes were made to the database and then rolled back

  • How many times a change has been made, rolled back, and re-deployed

  • When rollbacks happened in relation to other changes

  • Any other changes that modified your database at any time

It can be enabled in one of the following ways:

DBCLH Syntax

loading

2

Turn on structured logging.

Set the Structured Logging --log-format property to JSON or JSON_PRETTY with one of the provided methods.

Structured logging with parameters provides the forensic-level detail auditors need by capturing exactly who made changes, what values were applied, when and where execution occurred, and whether changes matched approved requests.

Structured logging format syntax

liquibase --log-format=JSON or JSON_PRETTY

3

Set the Structured logging --log-level property to a value.

Use this to define what to include in your structured logs. Valid values are FINE, INFO, WARN, and SEVERE.

Example: --log-level=INFO

FINE:FINE logging generates significantly more log data.. Most organizations use FINE when they require detailed forensic analysis or are undergoing an active audit review.

INFO: INFO logging ensures that you capture enough detail in your logs to show what Liquibase did during execution without drowning in excessive technical details. INFO level typically captures changeset execution, database connections, and completion status, precisely what you'd want documented for compliance.

WARN:WARN logging helps demonstrate that Liquibase is actively flagging potential compliance or operational risks during change execution.

SEVERE: SEVERE logging demonstrates that all critical failures are captured and can be traced back to specific change attempts, users, and timestamps, proving nothing is hidden from the audit trail.

4

Set the Structured Logging --log-file properties so the log data is sent to a file rather than to the console.

This is important if you want to capture a file to be ingested by your log analysis tool, such as Elastic or Cloudwatch, etc.

To do so, set the --log-file property equal to the log file of your choice in the file, as an environment variable, or in the CLI.

Example: liquibase --log-format=JSON_PRETTY --log-level=INFO update --log-file=mylogfile.log

Note: By default, console messages are included in your log. If you need to disable this, set: mirror-console-messages-to-log=false

5

Enable the Observability reports.

Enable the Observability reports by enabling them in the CLI or your Flow file. Once these are enabled, you can utilize all the reports below. Each one gives you insight into different aspects of your database changes.

  • The Update report tracks system, runtime, operation, and changeset information about database deployments.

  • The Diff report makes it easy to scan and understand the differences between two databases, identify and remediate those differences, and collaborate to troubleshoot them using the report.

  • The Checks report collects data about the Liquibase Policy checks executing against your database.

  • The Rollback report provides human-readable information about database rollbacks, including system, runtime, operation, and changeset details. 

liquibase update \
    --reports-enabled=true \
    --report-name=my_update_report.html

liquibase diff \
    --reports-enabled=true \
    --report-name=my_diff_report.html

liquibase checks run \
    --reports-enabled=true \
    --report-name=my_checks_report.html

liquibase rollback-count 1 \
    --reports-enabled=true \
    --report-name=my_rollback_report.html

Next steps

Once all the tooling is enabled, you are ready to begin producing the reports.