One citizen request may leave traces in five systems
A resident submits an application, pays a fee and receives no confirmation. Log correlation connects the relevant events across identity, payment, application and notification systems so the agency can reconstruct what happened.
Use stable correlation identifiers
Appropriate transaction and request references help link related events without exposing unnecessary personal information.
Distinguish stages
Submission, authorisation, settlement, case creation and notification are different events.
Handle distributed timing
Messages can be delayed or processed out of order. Record event time and processing time where relevant.
Protect log integrity
Access controls, retention and appropriate auditability support trustworthy investigation.
Detect missing handoffs
A successful payment without a case-creation event may reveal an incomplete workflow.
Support authorised correction
Correlated evidence should lead to responsible investigation and appropriate remedies.
Break-test: two retries create overlapping logs
Can investigators identify one underlying user action and distinguish duplicate effects?
Connected knowledge
See Distributed Transaction Audit Logs, Event Sequencing and GovTech.