Audit Logs
The creation and modification of Dremio resources are tracked and traceable via the sys.project.history.events table. Audit logging is enabled by default and available to users with administrative permissions on the project.
An event can take up to three hours to propagate to the system table. There is currently no maximum retention policy for audit events.
note
This is a subset of the events that Dremio supports.
Organization Events
Dremio supports audit logging for the following organization event types and actions. The sys.project.history.events table contains these events in the default project.
| Event Type | Actions | Description |
|---|---|---|
| BILLING_ACCOUNT | BILLING_ACCOUNT_ADD_PROJECT | Dremio added a new project to the billing account during project creation. |
| BILLING_ACCOUNT | BILLING_ACCOUNT_CREATE | A user created a billing account. |
| BILLING_ACCOUNT | BILLING_ACCOUNT_REMOVE_PROJECT | Dremio removed a project from the billing account during project deletion. |
| BILLING_ACCOUNT | BILLING_ACCOUNT_UPDATE | A user modified the billing account, such as the notification email address. |
| BILLING_TRANSACTION | TRANSACTION_CHARGE | Dremio recorded Dremio Consumption Unit (DCU) usage charges for the period. |
| BILLING_TRANSACTION | TRANSACTION_CREDIT_LOAD | Dremio loaded DCU credits into the billing account. |
| CATALOG | CREATE | A user created a new Open Catalog. Catalog creation is included with project creation. |
| CATALOG | DELETE | A user deleted an Open Catalog. Project deletion also deletes its primary Open Catalog. |
| CATALOG | UPDATE | A user updated an Open Catalog configuration. |
| CLOUD | CREATE_STARTED CREATE_COMPLETED | A user created a cloud. Clouds provide resources for running engines and storing metadata in a project. |
| CLOUD | DELETE_STARTED DELETE_COMPLETED | A user deleted a cloud. |
| CLOUD | UPDATE | A user updated a cloud. |
| CONNECTION | FORCE_LOGOUT | A user changed their password or deactivated another user, ending all of that user's sessions. |
| CONNECTION | LOGIN | A user logged in. |
| CONNECTION | LOGOUT | A user logged out. |
| EDITION | DOWNGRADE | A user downgraded the billing edition in the Dremio organization. |
| EDITION | UPGRADE | A user upgraded the billing edition in the Dremio organization. |
| IDENTITY_PROVIDER | CREATE | A user configured a new OpenID Connect (OIDC) identity provider integration. |
| IDENTITY_PROVIDER | DELETE | A user deleted an OIDC identity provider. |
| IDENTITY_PROVIDER | UPDATE | A user updated an OIDC identity provider configuration. |
| MODEL_PROVIDER_CONFIG | CREATE | A user created a new model provider in the Dremio organization. |
| MODEL_PROVIDER_CONFIG | UPDATE | A user updated a model provider in the Dremio organization. |
| MODEL_PROVIDER_CONFIG | DELETE | A user deleted a model provider in the Dremio organization. |
| MODEL_PROVIDER_CONFIG | SET_DEFAULT | A user set a new default model provider in the Dremio organization. |
| ORGANIZATION | CREATE_STARTED CREATE_COMPLETED | A user created the Dremio organization. |
| ORGANIZATION | DELETE_STARTED DELETE_COMPLETED | A user closed and deleted the Dremio organization. |
| ORGANIZATION | UPDATE | A user updated the Dremio Cloud organization. |
| PERSONAL_ACCESS_TOKEN | CREATE | A user created a new personal access token in their account. |
| PERSONAL_ACCESS_TOKEN | DELETE | A user deleted a personal access token. |
| PROJECT | CREATE_STARTED CREATE_COMPLETED | A user created a project in the Dremio organization. |
| PROJECT | DELETE_STARTED DELETE_COMPLETED | A user deleted a project. |
| PROJECT | HIBERNATE_STARTED HIBERNATE_COMPLETED | A user archived a project. |
| PROJECT | UNHIBERNATE_STARTED UNHIBERNATE_COMPLETED | A user activated an archived project. |
| PROJECT | UPDATE | A user updated the configuration of a project. |
| ROLE | CREATE | A user created a custom role. |
| ROLE | DELETE | A user deleted a role. |
| ROLE | MEMBERS_ADDED | A user added users or roles as members of a role. |
| ROLE | MEMBERS_REMOVED | A user removed users or roles as members of a role. |
| ROLE | UPDATE | A user updated the metadata of a custom role, such as the description. |
| USER_ACCOUNT | CREATE | A user added a user account. |
| USER_ACCOUNT | DELETE | A user deleted a user account. |
| USER_ACCOUNT | PASSWORD_CHANGE | A user updated their account password. |
| USER_ACCOUNT | UPDATE | A user updated user account metadata. |
Project Events
| Event Type | Actions | Description |
|---|---|---|
| AI_AGENT | REQUEST RESPONSE | A user sent a request to the AI Agent and received a response. |
| ENGINE | CREATE_STARTED CREATE_COMPLETED | A user created an engine. |
| ENGINE | DELETE_STARTED DELETE_COMPLETED | A user deleted an engine. |
| ENGINE | DISABLE_STARTED DISABLE_COMPLETED | A user disabled an engine. |
| ENGINE | ENABLE_STARTED ENABLE_COMPLETED | A user enabled an engine. |
| ENGINE | UPDATE_STARTED UPDATE_COMPLETED | A user updated an engine configuration. |
| ENGINE_SCALING | SCALE_DOWN_STARTED SCALE_DOWN_COMPLETED | Dremio scaled down an engine by stopping one or more running replicas. |
| ENGINE_SCALING | SCALE_UP_STARTED SCALE_UP_COMPLETED | Dremio scaled up an engine by starting one or more additional replicas. |
| LABEL | UPDATE | A user created a label on a dataset, source, or other object. |
| PIPE | CREATE | A user created an autoingest pipe for Apache Iceberg. |
| PIPE | DELETE | A user dropped an autoingest pipe. |
| PIPE | UPDATE | A user updated the configuration of an existing autoingest pipe. |
| PRIVILEGE | DELETE | A user deleted a privilege from a user or role. |
| PRIVILEGE | UPDATE | A user granted a privilege to a user or role. |
| REFLECTION | CREATE | A user created a new raw or aggregate Reflection. |
| REFLECTION | DELETE | A user deleted a Reflection. |
| REFLECTION | UPDATE | A user updated the content or configuration of a Reflection. |
| REPLICA | CREATE_STARTED CREATE_COMPLETED | Dremio started a replica during an ENGINE_SCALING scale-up event. |
| REPLICA | DELETE_STARTED DELETE_COMPLETED | Dremio stopped a replica during an ENGINE_SCALING scale-down event. |
| ROUTING_RULESET | UPDATE | A user modified an engine routing rule. |
| SUPPORT_SETTING | RESET | A user reset an advanced configuration or diagnostic setting. |
| SUPPORT_SETTING | SET | A user set an advanced configuration or diagnostic setting. |
| UDF | CREATE | A user created a user-defined function. |
| UDF | DELETE | A user deleted a user-defined function. |
| UDF | UPDATE | A user modified the SQL definition of a user-defined function. |
| WIKI | EDIT | A user created or updated a wiki. |
Open Catalog Events
These events appear in the sys.project.history.events table of the project where the catalog is designated as the primary catalog.
| Event Type | Actions | Description |
|---|---|---|
| FOLDER | CREATE | A user created a folder in the catalog. |
| FOLDER | DELETE | A user deleted a folder in the catalog. |
| TABLE | CREATE | A user created a table in the catalog. |
| TABLE | DELETE | A user deleted a table in the catalog. |
| TABLE | READ | A user read table information or data from the catalog. |
| TABLE | REGISTER | A user registered a new table in the catalog. |
| TABLE | UPDATE | A user updated a table definition in the catalog. |
| VIEW | CREATE | A user created a view in the catalog. |
| VIEW | DELETE | A user deleted a view in the catalog. |
| VIEW | READ | A user read a view in the catalog. |
| VIEW | UPDATE | A user updated a view definition in the catalog. |
Source Events
These events appear in the sys.project.history.events table for any source in the project.
| Event Type | Actions | Description |
|---|---|---|
| SOURCE | CREATE | A user created a data source. |
| SOURCE | DELETE | A user deleted a source connection. Any tables from the source were removed. |
| SOURCE | UPDATE | A user updated a source configuration. |
| FOLDER | CREATE | A user created a folder. |
| FOLDER | DELETE | A user deleted a folder. |
| TABLE | CREATE | A user created a non-catalog table. |
| TABLE | DELETE | A user deleted a non-catalog table. |
| TABLE | UPDATE | A user updated a table, or Dremio performed a metadata refresh on a non-Parquet table. |