Looking for descriptions of action_name column in system.access.audit.. specifically getTable

[WWoman]

Hi all,

I am looking for description of action_name column in system.access.audit. I am specifically interested in getTable, deleteTable and createTable. I believe the latter 2 are self descriptive but I'd like to confirm.

If getTable is related to accessing the data in the object (request_parame.full_name_arg) I would expect to see the SQL in request_params.commandText, but I am seeing a lot of NULL values.

[jacovangelder]

Have you read this? https://docs.databricks.com/en/admin/system-tables/audit-logs.html

I do agree that is a bit vague. But getTable seems to me when you do a DESCRIBE TABLE <table>, or view table metadata in the UI, so not accessing data in the table, but just metadata (getting the DDL). 

[WWoman]

That does sound like it makes sense, but what action(s) describes actually accessing the data in the table? 

[jacovangelder]

Judging by the docs, that is commandSubmit.

I'll have a try with it tomorrow if I have time.