topic Re: Looking for descriptions of action_name column in system.access.audit.. specifically getTable in Data Engineering

Looking for descriptions of action_name column in system.access.audit.. specifically getTable

WWoman — Tue, 11 Jun 2024 15:56:30 GMT

Hi all,

I am looking for description of action_name column in system.access.audit. I am specifically interested in getTable, deleteTable and createTable. I believe the latter 2 are self descriptive but I'd like to confirm.

If getTable is related to accessing the data in the object (request_parame.full_name_arg) I would expect to see the SQL in request_params.commandText, but I am seeing a lot of NULL values.

Re: Looking for descriptions of action_name column in system.access.audit.. specifically getTable

jacovangelder — Tue, 11 Jun 2024 17:20:28 GMT

Have you read this? https://docs.databricks.com/en/admin/system-tables/audit-logs.html

I do agree that is a bit vague. But getTable seems to me when you do a DESCRIBE TABLE <table>, or view table metadata in the UI, so not accessing data in the table, but just metadata (getting the DDL).

Re: Looking for descriptions of action_name column in system.access.audit.. specifically getTable

WWoman — Tue, 11 Jun 2024 18:23:14 GMT

That does sound like it makes sense, but what action(s) describes actually accessing the data in the table?

Re: Looking for descriptions of action_name column in system.access.audit.. specifically getTable

jacovangelder — Tue, 11 Jun 2024 18:27:49 GMT

Judging by the docs, that is commandSubmit.

I'll have a try with it tomorrow if I have time.