Databricks Administration and Monitoring/Auditing
Databricks Administration and Monitoring/Auditing is the framework through which the Databricks lakehouse platform records, delivers, and analyzes a history of activity across its workspaces and accounts. Its audit-logging capability gives administrators a centralized way to understand and govern activity happening on the platform,[^c1] with the main purpose of letting enterprise security teams and platform administrators track access to data and workspace resources through the various interfaces Databricks provides.[^c2]
Audit activity is organised into two classes: workspace-level audit logs with workspace-level events and account-level audit logs with account-level events.[^c3] Databricks delivers the logs in JSON format to a customer-owned cloud storage bucket, writing a separate file for each workspace and a separate file for account-level events.[^c4] Events share a common JSON structure across all resource types, with each action recorded as a separate event whose parameters sit in a canonical sparse struct called requestParams.[^c5] Alongside file delivery, Databricks recommends the managed audit log system table (system.access.audit) as the primary way to access an account's audit logs.[^c6]
Auditing is also embedded in the platform's data-governance layer. Unity Catalog automatically captures user-level audit logs that record access to data and captures lineage tracking how data assets are created and used across all languages.[^c7] The System Tables associated with the catalog automatically log every query, read, write, and modify on the platform, giving full visibility into user activity.[^c8] These records underpin a governance model in which extensive activity and query logs are available as queryable system tables that can also be delivered onward to log-monitoring tools or cloud object storage.[^c9]
The recorded history serves three recurring purposes. For security, comprehensive auditing of data-access events enables security reviews and the detection of abuse or data-exfiltration attempts.[^c10] For compliance, the audit trail and lineage supply the evidence that auditors require. For platform operations, the logs are used to monitor usage patterns, attribute activity to users, and control cost. Administrators apply these capabilities through the configuration, querying, and operational practices that this wiki describes.