Enable verbose audit logs

Verbose audit logs are additional audit logs recorded whenever a query or command is run in your workspace. These logs record the text of each command or query. By default, these logs are not enabled in workspaces.

To enable or disable verbose audit logs, do the following:

1. As a workspace admin, go to the Databricks admin settings page.

2. Click the Advanced tab.

3. Next to Verbose Audit Logs, enable or disable the feature.

When you enable or disable verbose logging, an auditable event is emitted in the category workspace with action workspaceConfKeys. The workspaceConfKeys request parameter is enableVerboseAuditLogs. The request parameter workspaceConfValues is true (feature enabled) or false (feature disabled).

Verbose audit log events

When you configure verbose audit logs, your logs include the following additional events:

Service	Action name	Description	Request parameters
notebook	runCommand	Emitted after an interactive user runs a command in a notebook. A command corresponds to a cell in a notebook.	notebookId executionTime status commandId commandText
jobs	runCommand	Emitted after a command in a notebook is executed by a job run. A command corresponds to a cell in a notebook.	jobId runId notebookId executionTime status commandId commandText
databrickssql	commandSubmit	Runs when a command is submitted to Databricks SQL.	commandText warehouseId commandId
databrickssql	commandFinish	Runs when a command completes or a command is cancelled.	warehouseId commandId

Check the response field for additional information related to the command result:

• statusCode - The HTTP response code. This will be error 400 if it is a general error.

• errorMessage - Error message.

  Note

  In some cases for certain long-running commands, the errorMessage field might not be populated on failure.

• result: This field is empty.