Audit log system table reference

Preview

This system table is in Public Preview.

This article outlines the audit log table schema and has sample queries you can use with the audit log system table to answer common account activity questions. For information on audit log events, see Audit log reference.

Table path: This system table is located at system.access.audit.

Audit log considerations

• Most audit logs are only available in the region of the workspace.
• Account-level audit logs record workspace_id as 0.

Audit log system table schema

The audit log system table uses the following schema:

Column name	Data type	Description	Example
account_id	string	ID of the account	23e22ba4-87b9-4cc2-9770-d10b894bxx
workspace_id	string	ID of the workspace	1234567890123456
version	string	Audit log schema version	2.0
event_time	timestamp	Timestamp of the event. Timezone information is recorded at the end of the value with +00:00 representing UTC timezone.	2023-01-01T01:01:01.123+00:00
event_date	date	Calendar date the action took place	2023-01-01
source_ip_address	string	IP address where the request originated	10.30.0.242
user_agent	string	Origination of request	Apache-HttpClient/4.5.13 (Java/1.8.0_345)
session_id	string	ID of the session where the request came from	123456789
user_identity	struct	Identity of user initiating request	{"email": "user@domain.com", "subjectName": null}
service_name	string	Service name initiating request	unityCatalog
action_name	string	Category of the event captured in audit log	getTable
request_id	string	ID of request	ServiceMain-4529754264
request_params	map	Map of key values containing all the request parameters. Depends on request type	[["full_name_arg", "user.chat.messages"], ["workspace_id", "123456789"], ["metastore_id", "123456789"]]
response	struct	Struct of response return values	{"statusCode": 200, "errorMessage": null, "result": null}
audit_level	string	Workspace or account level event	ACCOUNT_LEVEL
event_id	string	ID of the event	34ac703c772f3549dcc8671f654950f0
identity_metadata	struct	Identities involved in the action, including run_by and run_as. See Auditing group dedicated compute activity.	{run_by: example@email.com; run_as: example@email.com;