Query extended network traffic logs

Preview

This feature is in Private Preview. To try it, reach out to your Databricks contact.

This article describes how to query extended network traffic logs to analyze outbound network traffic from serverless compute. For an overview of what the logs record and how the tables relate, see Extended network traffic logs.

Requirements

• Your Databricks account must be enrolled in the extended network traffic logs Private Preview. To request enrollment, contact your Databricks account team.
• After your account is enrolled, an account admin must turn on the preview from the account console Previews page. See Manage account-level previews.
• You must have access to query system tables. See System tables reference.

Extended network traffic logs are available on any platform tier.

Query allowed network access events

The following query returns allowed outbound network access events from the last 24 hours, including the destination and its resolved IP addresses:

SQL

SELECT
  event_time,
  workspace_id,
  network_source_type,
  destination_type,
  destination,
  CASE
    WHEN destination_type = 'DNS'
      THEN dns_event.rdata
    WHEN destination_type = 'STORAGE'
      THEN storage_event.rdata
  END AS resolved_ips
FROM system.access.outbound_network
WHERE event_time >= current_timestamp() - INTERVAL 1 DAY
  AND access_type = 'ALLOWED'
ORDER BY event_time DESC;