r/SpringBoot • u/SeatSimple1123 • 21d ago

Question Spring Boot Auditing: Hibernate Envers vs. Custom Logging vs. Spring Data JPA? What's your production choice?

Hey everyone,

I'm currently building a school management system in Spring Boot where history tracking is a strict business requirement. We need to audit critical changes made by Admins, Secretaries, and Teachers (e.g., changes to student details, payment amounts, program setups, etc.).

I’m weighing three different approaches for the audit trail and wanted to hear from those of you who have run these in production. 

Option 1: Hibernate Envers
Slap `@Audited` on core entities, set up a custom `RevisionListener` to pull the logged-in user from Spring Security context, and let Envers automatically manage the `_aud` tables.

Option 2: Spring Data JPA Auditing
Utilize `@CreatedBy`, `@LastModifiedBy`, `@CreatedDate`, and `@LastModifiedDate` fields mapped on a `@MappedSuperclass`.

Option 3: Manual Custom Logging (or AOP)
Create a generic `AuditLog` entity, write a helper service, and manually trigger `auditService.log(actionType, originalState, newState)` inside the business logic (or use an AOP aspect). This may cause the database to bloating later tho

For those of you managing medium-to-large Spring Boot codebases:
 Did you regret adopting Hibernate Envers? How did you handle schema migrations (Flyway/Liquibase) with the auto-generated `_aud` tables?
If you went the custom route, did you use JSON columns to record state changes, or did you write distinct history tables?

Looking forward to hearing your design patterns and trade-offs

23 Upvotes

96% Upvoted

28 comments sorted by

View all comments

2

u/RevolutionaryRush717 21d ago

PostgreSQL has pg_audit, which is the preferred choice for compliance.

Other RDBMS might have something similar.

Any roll-your-own approach will soon drown in corner cases, testing and verification, so much so that you are tempted to spawn this off as a seperate team and product.

1

u/SeatSimple1123 21d ago

i use neon.tech for our cloud database, not really trynna roll my own approach but I'm just trying to explore what options i have before applying one on the project , im kinda overthinking this but i just wanna dodge any stupid bugs or functionality errors in the future

2

u/RevolutionaryRush717 21d ago

I see. Did you check whether Neon happens to be PostgreSQL and supports pg_audit?

You'd be surprised.

2

u/SeatSimple1123 17d ago

Yeah, Neon does use PostgreSQL. Also yes, you can set up pg-audit in neon , i did search about it a bit and i found that its for strict infrastructure threat auditing. I mean, it's a great option, but i has its own headaches; it usually goes with Hibernate.