Audit Logging

The creation and modification of Dremio resources is tracked and traceable via the sys.project.history.events table. Audit logging is enabled by default and is available to users with administrative permissions on the project.

It can take up to three hours for an event to propagate to the system table and there is currently no maximum retention policy for audit events.

Tracked Events

Dremio supports audit logging for the following actions:

• Access management changes (granting/revoking privileges) and object ownership changes
• Changes to Dremio resources and catalog objects (Create/Modify/Delete)
• Changes in engine state (scale up/down)
• Changes to the Dremio software edition (upgrade/downgrade to and from Enterprise edition)