PHP 怎么PHP 审计跟踪

wen PHP项目 2026-07-30 109

本文目录导读：

PHP 怎么PHP 审计跟踪

什么是审计跟踪
基础审计跟踪实现
自动审计跟踪系统
高级审计功能
最佳实践建议
监控和告警
实际使用的框架

我来详细介绍PHP审计跟踪的方法和实践。

什么是审计跟踪

审计跟踪是记录系统中所有关键操作的日志，用于追踪和审查用户行为、数据变更和系统事件。

基础审计跟踪实现

1 自定义审计日志函数

<?php
class AuditLogger {
    private $logFile;
    private $tableName;
    public function __construct() {
        $this->logFile = __DIR__ . '/logs/audit_' . date('Y-m-d') . '.log';
        $this->tableName = 'audit_logs';
    }
    /**
     * 记录审计日志
     */
    public function log($action, $details, $userId = null) {
        $logEntry = [
            'timestamp' => date('Y-m-d H:i:s'),
            'user_id' => $userId ?? $_SESSION['user_id'] ?? 'system',
            'ip_address' => $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0',
            'action' => $action,
            'details' => json_encode($details, JSON_UNESCAPED_UNICODE),
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? ''
        ];
        // 写入文件日志
        $this->writeFileLog($logEntry);
        // 写入数据库
        $this->writeDatabaseLog($logEntry);
    }
    private function writeFileLog($entry) {
        $logDir = dirname($this->logFile);
        if (!is_dir($logDir)) {
            mkdir($logDir, 0755, true);
        }
        $logLine = sprintf(
            "[%s] User: %s | IP: %s | Action: %s | Details: %s\n",
            $entry['timestamp'],
            $entry['user_id'],
            $entry['ip_address'],
            $entry['action'],
            $entry['details']
        );
        file_put_contents($this->logFile, $logLine, FILE_APPEND | LOCK_EX);
    }
    private function writeDatabaseLog($entry) {
        // 数据库写入逻辑
        // 使用PDO或MySQLi
        try {
            $pdo = new PDO('mysql:host=localhost;dbname=yourdb', 'user', 'pass');
            $stmt = $pdo->prepare("INSERT INTO audit_logs 
                (timestamp, user_id, ip_address, action, details, user_agent) 
                VALUES (?, ?, ?, ?, ?, ?)");
            $stmt->execute([
                $entry['timestamp'],
                $entry['user_id'],
                $entry['ip_address'],
                $entry['action'],
                $entry['details'],
                $entry['user_agent']
            ]);
        } catch (PDOException $e) {
            error_log("Audit log database error: " . $e->getMessage());
        }
    }
}

2 数据库表结构

-- 核心审计表
CREATE TABLE audit_logs (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    timestamp DATETIME NOT NULL,
    user_id INT,
    username VARCHAR(100),
    ip_address VARCHAR(45),
    action VARCHAR(255) NOT NULL,
    resource_type VARCHAR(100),
    resource_id INT,
    details TEXT,
    user_agent VARCHAR(500),
    session_id VARCHAR(100),
    request_uri VARCHAR(500),
    INDEX idx_timestamp (timestamp),
    INDEX idx_user_id (user_id),
    INDEX idx_action (action),
    INDEX idx_resource_type (resource_type)
);
-- 数据变更日志
CREATE TABLE data_changes (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    table_name VARCHAR(100) NOT NULL,
    record_id INT NOT NULL,
    field_name VARCHAR(100),
    old_value TEXT,
    new_value TEXT,
    changed_by INT,
    changed_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

自动审计跟踪系统

1 Middleware/拦截器方式

<?php
class AuditMiddleware {
    private $auditLogger;
    private $excludedPaths = ['/login', '/static/', '/api/heartbeat'];
    public function __construct() {
        $this->auditLogger = new AuditLogger();
    }
    public function handleRequest() {
        $requestUri = $_SERVER['REQUEST_URI'];
        // 排除不需要记录的路径
        foreach ($this->excludedPaths as $path) {
            if (strpos($requestUri, $path) === 0) {
                return; // 跳过记录
            }
        }
        // 记录请求
        $this->logRequest();
    }
    private function logRequest() {
        $action = strtoupper($_SERVER['REQUEST_METHOD']) . ' ' . $_SERVER['REQUEST_URI'];
        // 敏感操作需要记录详细数据
        if (in_array($_SERVER['REQUEST_METHOD'], ['POST', 'PUT', 'DELETE'])) {
            $details = [
                'post_data' => $this->sanitizeData($_POST),
                'query_string' => $_SERVER['QUERY_STRING'],
                'referer' => $_SERVER['HTTP_REFERER'] ?? ''
            ];
        } else {
            $details = ['query_string' => $_SERVER['QUERY_STRING']];
        }
        $this->auditLogger->log($action, $details);
    }
    /**
     * 过滤敏感数据
     */
    private function sanitizeData($data) {
        $sensitiveFields = ['password', 'token', 'secret', 'credit_card'];
        foreach ($sensitiveFields as $field) {
            if (isset($data[$field])) {
                $data[$field] = '***FILTERED***';
            }
        }
        return $data;
    }
}

2 数据库操作审计

<?php
class DatabaseAuditor {
    private $pdo;
    private $auditLogger;
    public function __construct($pdo) {
        $this->pdo = $pdo;
        $this->auditLogger = new AuditLogger();
    }
    /**
     * 更新记录并审计
     */
    public function updateWithAudit($table, $data, $where, $id) {
        // 获取旧数据
        $oldData = $this->getOldData($table, $where);
        // 执行更新
        $result = $this->executeUpdate($table, $data, $where);
        // 记录变更
        if ($result) {
            $this->logDataChanges($table, $id, $oldData, $data);
        }
        return $result;
    }
    private function logDataChanges($table, $id, $oldData, $newData) {
        $changes = [];
        foreach ($newData as $field => $newValue) {
            $oldValue = $oldData[$field] ?? null;
            if ($oldValue != $newValue) {
                $changes[] = [
                    'table' => $table,
                    'record_id' => $id,
                    'field' => $field,
                    'old_value' => $oldValue,
                    'new_value' => $newValue
                ];
            }
        }
        if (!empty($changes)) {
            $this->auditLogger->log("UPDATE {$table}", [
                'record_id' => $id,
                'changes' => $changes
            ]);
        }
    }
}

高级审计功能

1 用户行为分析

<?php
class UserBehaviorAnalyzer {
    public function detectSuspiciousActivity() {
        $suspiciousPatterns = [
            'multiple_failed_logins' => $this->checkFailedLogins(),
            'unusual_access_times' => $this->checkAccessTimes(),
            'rapid_requests' => $this->checkRequestRate(),
            'banned_resources_access' => $this->checkBannedResources()
        ];
        return array_filter($suspiciousPatterns);
    }
    /**
     * 检查高频访问
     */
    private function checkRequestRate() {
        $userId = $_SESSION['user_id'];
        $recentLogs = $this->getRecentLogs($userId, 60); // 最近60秒
        if (count($recentLogs) > 100) { // 超过100次请求
            return [
                'type' => 'rapid_requests',
                'severity' => 'high',
                'count' => count($recentLogs),
                'time_range' => '60 seconds'
            ];
        }
        return null;
    }
}

2 审计报告生成

<?php
class AuditReportGenerator {
    /**
     * 生成用户活动报告
     */
    public function generateUserReport($userId, $startDate, $endDate) {
        $activities = $this->getUserActivities($userId, $startDate, $endDate);
        $report = [
            'user_id' => $userId,
            'period' => "$startDate to $endDate",
            'total_actions' => count($activities),
            'action_summary' => $this->summarizeActions($activities),
            'peak_activity_hours' => $this->analyzePeakHours($activities),
            'most_frequent_actions' => $this->getFrequentActions($activities, 5)
        ];
        return $report;
    }
    private function summarizeActions($activities) {
        $summary = [];
        foreach ($activities as $activity) {
            $action = $activity['action'];
            if (!isset($summary[$action])) {
                $summary[$action] = 0;
            }
            $summary[$action]++;
        }
        return $summary;
    }
    private function analyzePeakHours($activities) {
        $hourCount = array_fill(0, 24, 0);
        foreach ($activities as $activity) {
            $hour = date('G', strtotime($activity['timestamp']));
            $hourCount[$hour]++;
        }
        return $hourCount;
    }
}

最佳实践建议

1 安全考虑

<?php
class SecureAuditLog {
    // 日志文件权限设置
    const LOG_FILE_PERMISSIONS = 0600; // 只有所有者可读写
    // 防止日志注入
    public function sanitizeLogData($data) {
        if (is_string($data)) {
            // 移除非打印字符
            $data = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $data);
            // 转义特殊字符
            return addslashes($data);
        }
        return $data;
    }
    // 日志轮转
    public function rotateLogs() {
        $maxSize = 100 * 1024 * 1024; // 100MB
        if (file_exists($this->logFile) && filesize($this->logFile) > $maxSize) {
            $newName = $this->logFile . '.' . date('Y-m-d_H-i-s');
            rename($this->logFile, $newName);
            // 压缩旧日志
            $this->compressLogFile($newName);
            // 删除30天前的日志
            $this->cleanupOldLogs(30);
        }
    }
}

2 性能优化

<?php
class OptimizedAuditLogger {
    private $buffer = [];
    private $bufferSize = 100; // 批量写入
    public function log($action, $details) {
        $this->buffer[] = [
            'timestamp' => date('Y-m-d H:i:s'),
            'action' => $action,
            'details' => $details
        ];
        // 缓冲区满时批量写入
        if (count($this->buffer) >= $this->bufferSize) {
            $this->flushBuffer();
        }
    }
    public function __destruct() {
        // 确保剩余日志写入
        $this->flushBuffer();
    }
    private function flushBuffer() {
        // 批量写入数据库
        // 使用事务提高性能
        $this->batchInsert($this->buffer);
        $this->buffer = [];
    }
    private function batchInsert($logs) {
        // 使用批量插入语句
    }
}

监控和告警

<?php
class AuditAlertSystem {
    private $alertRules = [
        'failed_login_threshold' => 5,  // 5次失败登录
        'time_window' => 300,           // 5分钟窗口
        'sensitive_actions' => [
            'delete_user', 'change_permissions', 'export_data'
        ]
    ];
    public function checkAndAlert($logEntry) {
        // 检查失败登录
        if ($logEntry['action'] === 'login_failed') {
            $this->checkFailedLoginAlert($logEntry);
        }
        // 检查敏感操作
        if (in_array($logEntry['action'], $this->alertRules['sensitive_actions'])) {
            $this->sendSensitiveActionAlert($logEntry);
        }
    }
    private function checkFailedLoginAlert($logEntry) {
        $userId = $logEntry['user_id'];
        $recentFails = $this->getRecentFailedLogins($userId, 
            $this->alertRules['time_window']);
        if ($recentFails >= $this->alertRules['failed_login_threshold']) {
            $this->sendAlert([
                'type' => 'brute_force_attempt',
                'user_id' => $userId,
                'ip' => $logEntry['ip_address'],
                'count' => $recentFails
            ]);
        }
    }
    private function sendAlert($alertInfo) {
        // 发送邮件、短信或webhook
        // 记录到告警日志
        error_log("AUDIT ALERT: " . json_encode($alertInfo));
    }
}