A record that can be interpreted by auditors to establish that an activity has taken place. This might include user login, file access, printing and triggers that indicate whether any actual or attempted security violations occurred.