Skip to main content

Audit Logs

Audit logs are detailed records of the activity your users are taking in Omni, which can be useful for security and performance analysis. These logs will be structured as a JSON payload, and they can be exported to an S3 bucket - please contact your Omni account team to get this configured.

Logs are batched out to S3 a few minutes after being written to. They can be retained for up to one year. You may see additional entries in the payload, which correspond to internal Omni metadata that can be ignored.

You must be an admin on your Omni instance to access audit logs.

Query Context log field definitions

documentIdentifier

The unique ID of your workbook or dashboard within Omni found within the URL for that document

event

The name of the audit log event. QUERY_CONTEXT is the event that occurs when a user loads a document (workbook or dashboard) and QUERY_EXECUTION are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a QUERY_CONTEXT event but may not be a corresponding QUERY_EXECUTION event as cache hits do not trigger a query execution.

message

Additional detail passed from the log

organizationID

A unique identifier for your organization within Omni

organizationUserID

This unique identifier for a given user within Omni and can be used to look up a user at https://<your-environment>.omniapp.co/users.

referrer

The URL of the page where the event was issued

timestamp

When the event occurred

traceID

A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT or DASHBOARD_DOWNLOAD event to the QUERY_EXECUTION events it ran.

url

The URL of the request where the event occurred

queryCount

This will show the maximum amount of query execution events that a query context event can trigger. Can be used to calculate cache hit rate as the denominator.

source

Will delineate if the query context event came from a dashboard or workbook

embedEntity

Returns whatever is in the entity field in the embed URL that is generated for that user if applicable

Query Execution log field definitions

timestamp

When the event occurred

duration

The total length of query execution within the warehouse

event

The name of the audit log event. QUERY_CONTEXT is the event that occurs when a user loads a document (workbook or dashboard) and QUERY_EXECUTION are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a QUERY_CONTEXT event but may not be a corresponding QUERY_EXECUTION event as cache hits do not trigger a query execution.

jobId

The corresponding query jobID in the given warehouse where the query is executed

message

The detail passed from the infra back to the user if applicable

omniQueryID

A uuid for the query being executed within Omni used to track for query killing

organizationID

A unique identifier for your organization within Omni

query

The query that was executed

traceID

A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT or DASHBOARD_DOWNLOAD event to the QUERY_EXECUTION events it ran.

Dashboard Download log field definitions

documentIdentifier

The unique ID of your workbook or dashboard within Omni found within the URL for that document

event

The name of the audit log event. DASHBOARD_DOWNLOAD is the event that occurs when a user downloads a full dashboard and QUERY_EXECUTION are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a DASHBOARD_DOWNLOAD event but may not be a corresponding QUERY_EXECUTION event as cache hits do not trigger a query execution.

message

Additional detail passed from the log to the user such as the query being executed if applicable

organizationID

A unique identifier for your organization within Omni

organizationUserID

This unique identifier for a given user within Omni and can be used to look up a user at https://<your-environment>.omniapp.co/users.

timestamp

When the event occurred

traceID

A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT or DASHBOARD_DOWNLOAD event to the QUERY_EXECUTION events it ran.

url

The URL of the request where the event occurred

embedEntity

Returns whatever is in the entity field in the embed URL that is generated for that user if applicable