Server logs in XProtect have traditionally been handled by a separate subsystem that was designed to satisfy the specific needs of audit logs. While this subsystem has worked well for many years, it stores logs in a proprietary format with limited visualization and no data correlation functionalities, creating complexity and limiting flexibil-ity, especially as customer environments grew and became distributed, requiring integration with external observ-ability tools.

OpenTelemetry is an open-source, vendor-neutral framework [5] that standardizes log emissions through OTLP and uses the OpenTelemetry Collector for transformations, routing, and integrations. These capabilities, com-bined with OpenTelemetry’s widespread adoption by leading observability platforms [6], make it an ideal choice to reduce architectural complexity and meet the demand for flexibility. At the same time, it allows audit log re-quirements to be enforced through backend policies without the need for custom development.