Audit Logging
The creation and modification of Dremio resources is tracked and traceable via the sys.project.history.events table. Audit logging is enabled by default and is available to users with administrative permissions on the project.
It can take up to three hours for an event to propagate to the system table and there is currently no maximum retention policy for audit events.
Tracked Events
Dremio provides events for organization objects, such as integrated identity providers and users, and project objects such as sources, engines, and reflections.
Organization Events
Dremio supports audit logging for the following organization event types and actions:
| Event Type | Actions |
|---|---|
| CLOUD | CREATE_STARTED, CREATE_COMPLETED, UPDATE, DELETE_STARTED, DELETE_COMPLETED |
| CONNECTION | LOGIN |
| EDITION | CREATE, DELETE, DOWNGRADE, MODIFY, UPGRADE |
| IDENTITY_PROVIDER | CREATE, UPDATE, DELETE |
| ORGANIZATION | CREATE_STARTED, CREATE_COMPLETED, UPDATE, DELETE_STARTED, DELETE_COMPLETED |
| PERSONAL_ACCESS_TOKEN | CREATE, DELETE |
| PROJECT | CREATE_STARTED, CREATE_COMPLETED, DELETE_STARTED, DELETE_COMPLETED, HIBERNATE_STARTED, HIBERNATE_COMPLETED, UNHIBERNATE_STARTED, UNHIBERNATE_COMPLETED, UPDATE |
| ROLE | CREATE, UPDATE, DELETE |
| USER_ACCOUNT | CREATE, UPDATE, DELETE |
The sys.project.history.events table contains these events in the default project.
Project Events
Dremio supports audit logging for the following project event types and actions:
| Event Type | Actions |
|---|---|
| ENGINE | CREATE_STARTED, CREATE_COMPLETED, UPDATE_STARTED, UPDATE_COMPLETED, DELETE_STARTED, DELETE_COMPLETED, ENABLE_STARTED, ENABLE_COMPLETED, DISABLE_STARTED, DISABLE_COMPLETED |
| ENGINE_SCALING | SCALE_UP_STARTED, SCALE_UP_COMPLETED, SCALE_DOWN_STARTED, SCALE_DOWN_COMPLETED |
| FOLDER | CREATE, UPDATE, DELETE |
| LABEL | UPDATE |
| PIPE | CREATE, UPDATE, DELETE |
| PRIVILEGE | UPDATE, DELETE |
| REFLECTION | CREATE, UPDATE, DELETE |
| REPLICA | CREATE_STARTED, CREATE_COMPLETED, DELETE_STARTED, DELETE_COMPLETED |
| ROUTING_RULESET | CREATE, UPDATE, DELETE |
| SOURCE | CREATE, UPDATE, DELETE |
| SUPPORT_SETTING | RESET, SET |
| TABLE | CREATE, UPDATE, DELETE |
| UDF | CREATE, UPDATE, DELETE |
| VIEW | CREATE, UPDATE, DELETE |
| WIKI | EDIT |