Skip to content

Access Audits

Databricks Unity Catalog, Databricks SQL and Amazon Redshift connectors can fetch access audits and send them to the Audit Server. The feature is off by default. Turn on Enable access audits in the Manage Access Audits section.

Field Unity Catalog Databricks SQL Redshift Meaning
Audit fetch schedule 0 0 */4 * * * 0 0 */4 * * * 0 */15 * * * * Six-field cron in UTC. - disables the schedule.
Delay window (seconds) 3600 3600 300 How far behind now each fetch stops, so late-arriving rows are not skipped.
Backfill window PT4H PT4H PT30M ISO-8601 duration the first run reaches back. For Redshift, keep it under 7 days.
Page size 1000 1000 1000 Rows per page. Pages must stay under the Audit Server's inbound size cap.
Request data cap (bytes) 4096 4096 4096 Maximum statement text kept. Longer text is truncated.
Hold watermark on failure off off off On: a page that could not be delivered is retried on the next run. Off: it is dropped.
Users to exclude empty empty empty Principals whose audits are dropped.
Workspaces to fetch audits from empty = all n/a n/a Unity Catalog only.
Databases to fetch audits from n/a n/a empty = all Redshift only.

Redshift also has Parse resources from SQL (on), SQL parse timeout (seconds) (2) and Audit query timeout (seconds) (120).

Statement text leaves the platform

Audit records carry the SQL statement text as it is, unless the platform redacts it. On Databricks SQL, set Request data cap (bytes) to 0 to send no statement text. Excluding the connector's own principal under Users to exclude keeps its scan and sweep queries out of the audit trail.

Prerequisites

  • Databricks SQL: the connector's principal must be a workspace admin to see other users' queries.
  • Redshift: the login needs superuser or SYSLOG ACCESS UNRESTRICTED. Without it, every fetch is held and nothing is delivered.