Enable verbose audit logs

  • Article

Verbose audit logs are additional audit logs recorded whenever a query or command is run in your workspace. By default, these logs are not enabled in workspaces.

To enable or disable verbose audit logs, do the following:

  1. As a workspace admin, go to the Azure Databricks admin settings page.
  2. Click the Advanced tab.
  3. Next to Verbose Audit Logs, enable or disable the feature.

When you enable or disable verbose logging, an auditable event is emitted in the category workspace with action workspaceConfKeys. The workspaceConfKeys request parameter is enableVerboseAuditLogs. The request parameter workspaceConfValues is true (feature enabled) or false (feature disabled).

Verbose audit log events

When you configure verbose audit logs, your logs include the following additional events:

Service Action name Description Request parameters
notebook runCommand Emitted after an interactive user runs a command in a notebook. A command corresponds to a cell in a notebook. * notebookId
* executionTime
* status
* commandId
* commandText
jobs runCommand Emitted after a command in a notebook is executed by a job run. A command corresponds to a cell in a notebook. * jobId
* runId
* notebookId
* executionTime
* status
* commandId
* commandText
databrickssql commandSubmit Runs when a command is submitted to Databricks SQL. * commandText
* warehouseId
* commandId
databrickssql commandFinish Runs when a command completes or a command is cancelled. * warehouseId
* commandId

Check the response field for additional information related to the command result:

  • statusCode - The HTTP response code. This will be error 400 if it is a general error.

  • errorMessage - Error message.

    Note

    In some cases for certain long-running commands, the errorMessage field might not be populated on failure.

  • result: This field is empty.