Audit log system table reference

Important

This system table is in Public Preview.

This article outlines the audit log table schema and has sample queries you can use with the audit log system table to answer common account activity questions. For information on audit log events, see Diagnostic log reference.

Table path: This system table is located at system.access.audit.

Audit log considerations

  • Most audit logs are only available in the region of the workspace.
  • Account-level audit logs record workspace_id as 0.
  • If the __databricks_internal catalog appears in audit events or other system tables, it is a reserved catalog that Azure Databricks uses to store internal state. See The __databricks_internal catalog.
  • For some events, keys in request_params that contain SQL definitions are omitted unless you are an account admin or a member of the databricks_pii_access group. See Access masked request parameters.

Audit log system table schema

The audit log system table uses the following schema:

Column name Data type Description Example
account_id string ID of the account 23e22ba4-87b9-4cc2-9770-d10b894bxx
workspace_id string ID of the workspace 1234567890123456
version string Audit log schema version 2.0
event_time timestamp Timestamp of the event. Timezone information is recorded at the end of the value with +00:00 representing UTC timezone. 2023-01-01T01:01:01.123+00:00
event_date date Calendar date the action took place. To improve query performance, filter on event_date rather than event_time. 2023-01-01
source_ip_address string IP address where the request originated 10.30.0.242
user_agent string Origination of request Apache-HttpClient/4.5.13 (Java/1.8.0_345)
session_id string ID of the session where the request came from 123456789
user_identity struct Identity of user initiating request {"email": "user@domain.com",
"subjectName": null}
service_name string Service name initiating request unityCatalog
action_name string Category of the event captured in audit log getTable
request_id string ID of request ServiceMain-4529754264
request_params map Map of key values containing all the request parameters. Depends on request type. For some events, keys that contain SQL definitions are omitted unless you are an account admin or a member of the databricks_pii_access group. See Access masked request parameters. [["full_name_arg", "user.chat.messages"],
["workspace_id", "123456789"],
["metastore_id", "123456789"]]
response struct Struct of response return values {"statusCode": 200, "errorMessage": null,
"result": null}
audit_level string Workspace or account level event ACCOUNT_LEVEL
event_id string ID of the event 34ac703c772f3549dcc8671f654950f0
identity_metadata struct Identities involved in the action, including run_by and run_as. See Auditing group dedicated compute activity. {run_by: example@email.com;
run_as: example@email.com;

Access masked request parameters

Some audit events store SQL definitions in request_params. Those keys are omitted unless you are an account admin or a member of the databricks_pii_access account-level group:

  • function_info
  • view_definition
  • definition_json
  • managed_definition

Other keys in request_params and all other columns are unchanged. Access to unmasked values uses the same databricks_pii_access group as the query history system table. See Access masked statement text.

  • Last updated on