Audit logs
Audit logs are detailed records of the activity your users are taking in Omni, which can be useful for security and performance analysis. Events included in logs are structured as JSON payloads and sent in batches to Amazon S3 a few minutes after they're written.
Setup
Contact Omni support to request and set up this feature.
Once configured, Instance Admin permissions are required to access audit logs.
Data retention
By default, logs are retained for at least one year. Contact Omni support if you need a shorter retention period.
Event payloads
Toggle the sections below to learn about the fields that each event type contains. Note: Payloads can contain Omni metadata, which can be safely ignored.
Query context eventsOccurs when a user loads a document (workbook or dashboard)
| Name | Description |
|---|---|
| timestamp | The time the event occurred |
| documentIdentifier | The unique ID of the workbook or dashboard within Omni, found within the URL for the document |
| event | The type of the event. For query context events, this will be QUERY_CONTEXT |
| message | Additional detail passed from the log |
| organizationID | The unique identifier for the Omni organization |
| organizationUserID | The unique identifier for the Omni user associated with the event |
| referrer | The URL of the page where the event was issued |
| traceID | A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run. |
| url | The URL of the page where the event occurred |
| queryCount | The maximum number of query execution events that a query context event can trigger. Can be used to calculate cache hit rate as the denominator. |
| source | The source of the query context event: dashboard or workbook |
| embedEntity | If applicable, the value will be the value of the entity field in an embed URL generated for a user |
Query execution eventsOccurs when a user runs a query, which may be sent back to the warehouse
| Name | Description |
|---|---|
| timestamp | The time the event occurred |
| duration | The total length of query execution within the warehouse |
| event | The type of the event. For query execution events, this will be QUERY_EXECUTION |
| jobId | The ID of the corresponding job in the warehouse where the query was executed |
| message | Detail passed from the infrastructure back to the user, if applicable |
| omniQueryID | A uuid for the query being executed within Omni. Used for query killing purposes. |
| organizationID | The unique identifier for the Omni organization |
| query | The query that was executed |
| traceID | A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run. |
Dashboard download eventsOccurs when a user downloads a full dashboard
| Name | Description |
|---|---|
| timestamp | The time the event occurred |
| documentIdentifier | The unique ID of the workbook or dashboard within Omni, found within the URL for the document |
| event | The type of the event. For dashboard downloads, this will be DASHBOARD_DOWNLOAD |
| message | Additional detail passed from the log |
| organizationID | The unique identifier for the Omni organization |
| organizationUserID | The unique identifier for the Omni user associated with the event |
| traceID | A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run. |
| url | The URL of the page where the event occurred |
| embedEntity | If applicable, the value will be the value of the entity field in an embed URL generated for a user |