Databricks Audit Logs, Where the log files are stored? How to read them?

[Mado]

Hi,

I want to access the Databricks Audit Logs to check user activity. For example, the number of times that a table was viewed by a user.

I have a few questions in this regard.

1) Where the log files are stored? Are they stored on DBFS?

2) Can I read log files and save them as a table (let's say a delta table)?

If Log files are saved somewhere like DBFS, I might be able to read files by SQL language. 

I'd like to know if there is any way to get Logs as a Databricks table. I mean, saving the Logs as a table.

Also, I want it to work continuously; adding new logs to the table when a new event happens (not just one time).

I am not sure if I can use SQL language for this purpose or not (instead of Rest API).

Any idea how to do that?

[Debayan]

Hi, The audit log delivery can be delivered in storage buckets. Please refer: https://docs.databricks.com/administration-guide/account-settings/audit-logs.html#configure-audit-lo...

[Mado]

Thanks.

Can we access Logs in the Databricks platform, instead of sending them to a storage account?

[Anonymous]

Hi @Mohammad Saber​ 

Hope all is well! Just wanted to check in if you were able to resolve your issue and would you be happy to share the solution or mark an answer as best? Else please let us know if you need more help. 

We'd love to hear from you.

Thanks!