Audit Logging

The creation and modification of Dremio resources are tracked and traceable via the sys.project.history.events table. Audit logging is enabled by default and available to users with administrative permissions on the project.

An event can take up to three hours to propagate to the system table, and there is currently no maximum retention policy for audit events.

Tracked Events

Dremio provides events for organization objects, such as integrated identity providers and users, and project objects such as sources, engines, and reflections.

Organization Events

Dremio supports audit logging for the following organization event types and actions:

Event Type	Actions	Description
BILLING_ACCOUNT	BILLING_ACCOUNT_ADD_PROJECT	Dremio added a new project to the billing account during project creation.
BILLING_ACCOUNT	BILLING_ACCOUNT_CREATE	A user created a billing account.
BILLING_ACCOUNT	BILLING_ACCOUNT_REMOVE_PROJECT	Dremio removed a project from the billing account during project deletion.
BILLING_ACCOUNT	BILLING_ACCOUNT_UPDATE	A user modified the billing account, such as the notification email address.
BILLING_TRANSACTION	TRANSACTION_CHARGE	Dremio recorded Dremio Consumption Unit (DCU) usage charges for the period.
BILLING_TRANSACTION	TRANSACTION_CREDIT_LOAD	Dremio loaded DCU credits into the billing account.
CLOUD	CREATE_STARTED CREATE_COMPLETED	A user created a cloud. Clouds provide resources for running engines and storing metadata in a project.
CLOUD	DELETE_STARTED DELETE_COMPLETED	A user deleted a cloud.
CLOUD	UPDATE	A user updated a cloud.
CONNECTION	FORCE_LOGOUT	A user changed their password or deactivated another user, ending all of that user's sessions.
CONNECTION	LOGIN	A user logged in.
CONNECTION	LOGOUT	A user logged out.
EDITION	DOWNGRADE	A user downgraded the billing edition in the Dremio organization.
EDITION	UPGRADE	A user upgraded the billing edition in the Dremio organization.
IDENTITY_PROVIDER	CREATE	A user configured a new OpenID Connect (OIDC) identity provider integration.
IDENTITY_PROVIDER	DELETE	A user deleted an OIDC identity provider.
IDENTITY_PROVIDER	UPDATE	A user updated an OIDC identity provider configuration.
ORGANIZATION	CREATE_STARTED CREATE_COMPLETED	A user created the Dremio Cloud organization.
ORGANIZATION	DELETE_STARTED DELETE_COMPLETED	A user closed and deleted the Dremio Cloud organization.
ORGANIZATION	UPDATE	A user updated the Dremio Cloud organization.
PERSONAL_ACCESS_TOKEN	CREATE	A user created a new personal access token in their account.
PERSONAL_ACCESS_TOKEN	DELETE	A user deleted a personal access token.
PROJECT	CREATE_STARTED CREATE_COMPLETED	A user created a project in the Dremio Cloud organization.
PROJECT	DELETE_STARTED DELETE_COMPLETED	A user deleted a project.
PROJECT	HIBERNATE_STARTED HIBERNATE_COMPLETED	A user archived a project.
PROJECT	UNHIBERNATE_STARTED UNHIBERNATE_COMPLETED	A user activated an archived project.
PROJECT	UPDATE	A user updated the configuration of a project.
ROLE	CREATE	A user created a custom role.
ROLE	DELETE	A user deleted a role.
ROLE	UPDATE	A user updated a custom role.
ROLE	MEMBERS_ADDED	A user added users or roles as members of a role.
ROLE	MEMBERS_REMOVED	A user removed users or roles as members of a role.
ROLE	UPDATE	A user updated the metadata of a custom role, such as the description.
USER_ACCOUNT	CREATE	A user added a user account.
USER_ACCOUNT	DELETE	A user deleted a user account.
USER_ACCOUNT	PASSWORD_CHANGE	A user updated their account password.
USER_ACCOUNT	UPDATE	A user updated user account metadata.

The sys.project.history.events table contains these events in the default project.

Project Events

Dremio supports audit logging for the following project event types and actions:

Event Type	Actions	Description
ENGINE	CREATE_STARTED CREATE_COMPLETED	A user created an engine.
ENGINE	DELETE_STARTED DELETE_COMPLETED	A user deleted an engine.
ENGINE	DISABLE_STARTED DISABLE_COMPLETED	A user disabled an engine.
ENGINE	ENABLE_STARTED ENABLE_COMPLETED	A user enabled an engine.
ENGINE	UPDATE_STARTED UPDATE_COMPLETED	A user updated an engine configuration.
ENGINE_SCALING	SCALE_DOWN_STARTED SCALE_DOWN_COMPLETED	Dremio scaled down an engine by stopping one or more running replicas.
ENGINE_SCALING	SCALE_UP_STARTED SCALE_UP_COMPLETED	Dremio scaled up an engine by starting one or more additional replicas.
FOLDER	CREATE	Dremio created a managed folder.
FOLDER	DELETE	Dremio deleted a managed folder.
LABEL	UPDATE	A user created a label on a dataset, source, or other object.
PIPE	CREATE	A user created an autoingest pipe for Apache Iceberg.
PIPE	DELETE	A user dropped an autoingest pipe.
PIPE	UPDATE	A user updated the configuration of an existing autoingest pipe.
PRIVILEGE	DELETE	A user deleted a privilege from a user or role.
PRIVILEGE	UPDATE	A user granted a privilege to a user or role.
REFLECTION	CREATE	A user created a new raw or aggregate reflection.
REFLECTION	DELETE	A user deleted a reflection.
REFLECTION	UPDATE	A user updated the content or configuration of a reflection.
REPLICA	CREATE_STARTED CREATE_COMPLETED	Dremio started a replica during an ENGINE_SCALING scale up event.
REPLICA	DELETE_STARTED DELETE_COMPLETED	Dremio stopped a replica during an ENGINE_SCALING scale down event.
ROUTING_RULESET	UPDATE	A user modified an engine routing rule.
SOURCE	CREATE	A user created a Dremio data source.
SOURCE	DELETE	A user deleted a Dremio source connection. Any tables from the source were removed.
SOURCE	UPDATE	A user updated a Dremio source configuration.
SUPPORT_SETTING	RESET	A user reset an advanced configuration or diagnostic setting.
SUPPORT_SETTING	SET	A user set an advanced configuration or diagnostic setting.
TABLE	CREATE	A user created a non-catalog table.
TABLE	DELETE	A user deleted a non-catalog table.
TABLE	UPDATE	Generated by one of the following: A user updated a table configuration. Dremio performed a scheduled metadata refresh on a non-parquet table. A user performed a manual metadata refresh on a non-parquet table.
UDF	CREATE	A user created a user-defined function.
UDF	DELETE	A user deleted a user-defined function.
UDF	UPDATE	A user modified the SQL definition of a user-defined function.
WIKI	EDIT	A user created or updated a wiki.