Enable verbose audit logs

Verbose audit logs are additional audit logs recorded whenever a query or command is run in your workspace. These logs record the text of each command or query. By default, these logs are not enabled in workspaces.

To enable or disable verbose audit logs, do the following:

  1. As a workspace admin, go to the Databricks admin settings page.

  2. Click the Advanced tab.

  3. Next to Verbose Audit Logs, enable or disable the feature.

When you enable or disable verbose logging, an auditable event is emitted in the category workspace with action workspaceConfKeys. The workspaceConfKeys request parameter is enableVerboseAuditLogs. The request parameter workspaceConfValues is true (feature enabled) or false (feature disabled).

Verbose audit log events

When you configure verbose audit logs, your logs include the following additional events:

Service

Action name

Description

Request parameters

notebook

runCommand

Emitted after an interactive user runs a command in a notebook. A command corresponds to a cell in a notebook.

  • notebookId

  • executionTime

  • status

  • commandId

  • commandText

jobs

runCommand

Emitted after a command in a notebook is executed by a job run. A command corresponds to a cell in a notebook.

  • jobId

  • runId

  • notebookId

  • executionTime

  • status

  • commandId

  • commandText

databrickssql

commandSubmit

Runs when a command is submitted to Databricks SQL.

  • commandText

  • warehouseId

  • commandId

databrickssql

commandFinish

Runs when a command completes or a command is cancelled.

  • warehouseId

  • commandId

Check the response field for additional information related to the command result:

  • statusCode - The HTTP response code. This will be error 400 if it is a general error.

  • errorMessage - Error message.

    Note

    In some cases for certain long-running commands, the errorMessage field might not be populated on failure.

  • result: This field is empty.