Is it a bad idea to write audit/access/transaction log information directly to the filesystem?

Question

In addition to some custom post types, my application has two custom tables in the WP database. I'd like to keep a record of all inserts/updates/deletes to these two tables.

This audit trail won't be front-ended, and it won't be used often. I'd like it in place for my own diagnostic purposes. The application will be installed at 5-10 sites, and I expect to see fewer than 10,000 of these actions per year at each site.

I'm considering these options:

1. a custom post type (with no post meta)
2. a custom table in the WP database
3. a simple append-only file in the filesystem

Option 3 seems simplest, and it avoids gunking up the WP DB with this non-critical data. But writing data directly to the filesystem seems wrong somehow, and it doesn't seem to be a common approach.

Are there strong reasons to choose options 1 or 2 instead of writing to the filesystem?

Answer 1

There is nothing wrong with writing logs to a file, you just need to make sure you create a special directory for it and add .htaccess that will prevent listing, and probably deny all access to it from the web.

There is nothing overly wrong with storing data in the DB provided you do it in its own table, but unless you need to be able to filter the data online, it is probably just pointless overhead (in the end, DBs store everything as files...).

The advantage of having a DB table is that it is easier to create it using the WP DB APIs, but it is much harder to extract the information if you need the full log. (you need to explicitly write the code to do that, might run into memory limitations, etc)