Audit Logging
The creation and modification of Dremio resources is tracked and traceable via the sys.project.history.events table. Audit logging is enabled by default and is available to users with administrative permissions on the project.
It can take up to three hours for an event to propagate to the system table and there is currently no maximum retention policy for audit events.
Tracked Events
Dremio supports audit logging for the following objects (event types) and actions:
| Event Type | Actions |
|---|---|
| CLOUD | CREATE_STARTED, CREATE_COMPLETED, UPDATE, DELETE_STARTED, DELETE_COMPLETED |
| CONNECTION | LOGIN |
| EDITION | CREATE, DELETE, DOWNGRADE, MODIFY, UPGRADE |
| ENGINE | CREATE_STARTED, CREATE_COMPLETED, UPDATE_STARTED, UPDATE_COMPLETED, DELETE_STARTED, DELETE_COMPLETED, ENABLE_STARTED, ENABLE_COMPLETED, DISABLE_STARTED, DISABLE_COMPLETED |
| ENGINE_SCALING | SCALE_UP_STARTED, SCALE_UP_COMPLETED, SCALE_DOWN_STARTED, SCALE_DOWN_COMPLETED |
| FOLDER | CREATE, UPDATE, DELETE |
| ORGANIZATION | CREATE_STARTED, CREATE_COMPLETED, UPDATE, DELETE_STARTED, DELETE_COMPLETED |
| PERSONAL_ACCESS_TOKEN | CREATE, DELETE |
| PHYSICAL_DATASET | CREATE, UPDATE, DELETE |
| PRIVILEGE | UPDATE, DELETE |
| PROJECT | CREATE_STARTED, CREATE_COMPLETED, DELETE_STARTED, DELETE_COMPLETED, HIBERNATE_STARTED, HIBERNATE_COMPLETED, UNHIBERNATE_STARTED, UNHIBERNATE_COMPLETED, UPDATE |
| REFLECTION | CREATE, UPDATE, DELETE |
| REPLICA | CREATE_STARTED, CREATE_COMPLETED, DELETE_STARTED, DELETE_COMPLETED |
| ROUTING_RULESET | CREATE, UPDATE, DELETE |
| SOURCE | CREATE, UPDATE, DELETE |
| SUPPORT_SETTING | RESET, SET |
| TABLE | CREATE, UPDATE, DELETE |
| USER_ACCOUNT | CREATE, UPDATE, DELETE |
| VIEW | CREATE, UPDATE, DELETE |