Skip to main content

Audit Logs

Audit logs are detailed records of the activity your users are taking in Omni, which can be useful for security and performance analysis. These logs will be structured as a JSON payload, and they can be exported to an S3 bucket - please contact your Omni account team to get this configured.

Logs are batched out to S3 a few minutes after being written to. They can be retained for up to one year. You may see additional entries in the payload, which correspond to internal Omni metadata that can be ignored.

You must be an admin on your Omni instance to access audit logs.

Query Context log field definitions​

documentIdentifier​

The unique ID of your workbook or dashboard within Omni found within the URL for that document

event​

The name of the audit log event. QUERY_CONTEXT is the event that occurs when a user loads a document (workbook or dashboard) and QUERY_EXECUTION are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a QUERY_CONTEXT event but may not be a corresponding QUERY_EXECUTION event as cache hits do not trigger a query execution.

message​

Additional detail passed from the log

organizationID​

A unique identifier for your organization within Omni

organizationUserID​

This unique identifier for a given user within Omni and can be used to look up a user at https://<your-environment>.omniapp.co/users.

referrer​

The URL of the page where the event was issued

timestamp​

When the event occurred

traceID​

A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT or DASHBOARD_DOWNLOAD event to the QUERY_EXECUTION events it ran.

url​

The URL of the request where the event occurred

queryCount​

This will show the maximum amount of query execution events that a query context event can trigger. Can be used to calculate cache hit rate as the denominator.

source​

Will delineate if the query context event came from a dashboard or workbook

embedEntity​

Returns whatever is in the entity field in the embed URL that is generated for that user if applicable

Query Execution log field definitions​

timestamp​

When the event occurred

duration​

The total length of query execution within the warehouse

event​

The name of the audit log event. QUERY_CONTEXT is the event that occurs when a user loads a document (workbook or dashboard) and QUERY_EXECUTION are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a QUERY_CONTEXT event but may not be a corresponding QUERY_EXECUTION event as cache hits do not trigger a query execution.

jobId​

The corresponding query jobID in the given warehouse where the query is executed

message​

The detail passed from the infra back to the user if applicable

omniQueryID​

A uuid for the query being executed within Omni used to track for query killing

organizationID​

A unique identifier for your organization within Omni

query​

The query that was executed

traceID​

A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT or DASHBOARD_DOWNLOAD event to the QUERY_EXECUTION events it ran.

Dashboard Download log field definitions​

documentIdentifier​

The unique ID of your workbook or dashboard within Omni found within the URL for that document

event​

The name of the audit log event. DASHBOARD_DOWNLOAD is the event that occurs when a user downloads a full dashboard and QUERY_EXECUTION are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a DASHBOARD_DOWNLOAD event but may not be a corresponding QUERY_EXECUTION event as cache hits do not trigger a query execution.

message​

Additional detail passed from the log to the user such as the query being executed if applicable

organizationID​

A unique identifier for your organization within Omni

organizationUserID​

This unique identifier for a given user within Omni and can be used to look up a user at https://<your-environment>.omniapp.co/users.

timestamp​

When the event occurred

traceID​

A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT or DASHBOARD_DOWNLOAD event to the QUERY_EXECUTION events it ran.

url​

The URL of the request where the event occurred

embedEntity​

Returns whatever is in the entity field in the embed URL that is generated for that user if applicable