Implementing Audit Logs for Self-Hosted OSS

[isbee]

Describe your question

I want to implement audit logs feature on my own. I think this is feasible because Langfuse OSS is 'free' licensed, but I want to clarify the licensing boundaries before proceeding.

What I've Found

Looking at the codebase, I see:

1. MIT Licensed (can use freely):
   • web/src/features/audit-logs/auditLog.ts - The core audit logging function (web/src/features/audit-logs/auditLog.ts)
   • audit_logs table in Postgres schema (packages/shared/prisma/schema.prisma)
   • web/src/server/api/routers/auditLogs.ts - The tRPC router (with entitlement check)
   • Various places that call auditLog() throughout the codebase
2. EE Licensed (can't be used freely):
   • web/src/ee/features/audit-log-viewer/- The UI components

So the audit log infrastructure (database table, write function, API router) is part of the free-license. The audit events are already being written to the database when actions occur (creating prompts, score configs, API keys, etc.).

Only the viewer UI is under the EE license.

Question

If the above is correct, would Option A be acceptable?:

• Option A: Use existing infrastructure + custom UI
  • Keep the existing audit_logs table and auditLog() function
  • Remove entitlement check from the tRPC router
  • Write a new viewer UI from scratch (not copying EE code)
• Option B: Fully independent implementation
  • Create a new table (e.g., custom_audit_logs)
  • Implement my own audit insertion logic
  • Build custom viewer UI

Langfuse Cloud or Self-Hosted?

Self-Hosted

If Self-Hosted

latest

If Langfuse Cloud

No response

SDK and integration versions

latest

Pre-Submission Checklist

• I have checked for existing issues/discussions and consulted Langfuse AI.

[inkeep-ai-assistant[bot]]

Based on the available sources, your understanding is correct. The Langfuse licensing model explicitly permits modifying and extending the MIT-licensed core code without using Enterprise Edition modules(1).

A Langfuse maintainer has confirmed that implementing features similar to Enterprise functionality by modifying the open-source code—without using or circumventing any protected Enterprise Edition modules (code under the /ee folder or gated by the license key mechanism)—would not constitute a breach of licensing terms(2).

The audit logs infrastructure is part of the MIT-licensed core. While the audit_logs table exists and collects data in the open source version, the audit log viewer and export functionality require an Enterprise license(3)(4).

Option A appears permissible based on the licensing guidance. You can use the existing MIT-licensed infrastructure (audit_logs table and auditLog() function) and build your own viewer UI from scratch, as long as you're not copying or circumventing the /ee code(2).

The audit log system captures actor information (User ID or API Key ID), resource details (resource type and ID), actions performed, context (organization ID, project ID, role), state capture (before/after states as JSON), and timestamps(4).

For the open source version, audit log entries are collected in the database, but there's no official API or UI to access them without an Enterprise license(4). Accessing them directly requires querying the database yourself(4).

Key consideration: While modifying the tRPC router to remove entitlement checks is technically within your rights under the MIT license, ensure you're not inadvertently using any /ee directory code paths.

📚 Sources:

1. Why is Langfuse Open Source? - Langfuse Handbook
2. Inquiry on Licensing for Self-Implemented Enterprise Features (Project-Level RBAC) on Langfuse OSS
3. Audit Logs
4. Audit logs schema using open source langfuse

---

Have another question? Just tag @inkeep.

[jannikmaierhoefer]

@isbee, yes inkeep is correct!