What is the difference between ACL audit trail and client analytics?

ACL audit trail persists who accessed what, over time – an identity-and-permissions history aimed at compliance and post-incident review, the kind of record you pull up after something went wrong to answer "who touched this."

Client analytics instead attributes ongoing traffic by client name and connection pattern, answering an operational question – "which service is responsible for this load right now" – rather than a compliance one.

Both draw on the same underlying connection and command data, but audit trail is retained specifically for accountability, while client analytics is oriented toward live or near-live operational attribution.

A useful way to keep them apart: if the question is "prove who did this after the fact," you want the audit trail; if the question is "which of our microservices is generating this load right now," you want client analytics, and the two often get used together during an incident – analytics to find the noisy client, then the audit trail to confirm exactly what it did and when.