I’m working on a data usage use case and want to understand the right way to get read bytes and written bytes per table in Databricks, especially for Unity Catalog tables.

What I want

For each table, something like:

• Date

• Table name (catalog.schema.table)

• Operation type (read/write)

• User

• Bytes read

• Bytes written

Initially, I assumed I could get this directly from the UC audit logs via the system.access.audit system table, because that’s the “audit log” source. But while exploring, I realized a few things are missing

1. system.access.audit

   • Focused on governance and admin actions (e.g., grants, ownership changes, some access checks).

   • Great for “who did what” from a security perspective.

   • Does not expose per-table read bytes / written_bytes metrics.

Is there any direct way from system.access.audit to get per-table read/write bytes, or is audit intentionally scoped only to governance events (and not IO metrics)?