Techniques are provided for recording, in an audit log data store, log records that satisfy one or more audit log rules. Audit log rules may be associated with one or more context attributes. Specifically, based on the context attribute of a given rule, embodiments store, in the audit log data store, additional log records that are associated with the context attribute value from log records that satisfied the rule. Because a context attribute may span multiple systems that implement a multi-system operation, the information in the audit log data store may include cross-system contextual information for changes that are of interest to administrators. The audit log data store may be efficiently queried to provide information regarding multi-system operations because of the targeted nature of the audit log data gathering techniques. Automatically-generated indexes on audit log data provide additional efficiency gains for executing queries over the audit log data.