Audit Logs
Audit logs are detailed records of the activity your users are taking in Omni, which can be useful for security and performance analysis. These logs will be structured as a JSON payload, and they can be exported to an S3 bucket - please contact your Omni account team to get this configured.
Logs are batched out to S3 a few minutes after being written to. They can be retained for up to one year. You may see additional entries in the payload, which correspond to internal Omni metadata that can be ignored.
You must be an admin on your Omni instance to access audit logs.
Query Context log field definitions
documentIdentifier
The unique ID of your workbook or dashboard within Omni found within the URL for that document
event
The name of the audit log event. QUERY_CONTEXT
is the event that occurs when a user loads a document (workbook or dashboard) and QUERY_EXECUTION
are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a QUERY_CONTEXT
event but may not be a corresponding QUERY_EXECUTION
event as cache hits do not trigger a query execution.
message
Additional detail passed from the log
organizationID
A unique identifier for your organization within Omni
organizationUserID
This unique identifier for a given user within Omni and can be used to look up a user at https://<your-environment>.omniapp.co/users
.
referrer
The URL of the page where the event was issued
timestamp
When the event occurred
traceID
A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT
or DASHBOARD_DOWNLOAD
event to the QUERY_EXECUTION
events it ran.
url
The URL of the request where the event occurred
queryCount
This will show the maximum amount of query execution events that a query context event can trigger. Can be used to calculate cache hit rate as the denominator.
source
Will delineate if the query context event came from a dashboard or workbook
embedEntity
Returns whatever is in the entity field in the embed URL that is generated for that user if applicable
Query Execution log field definitions
timestamp
When the event occurred
duration
The total length of query execution within the warehouse
event
The name of the audit log event. QUERY_CONTEXT
is the event that occurs when a user loads a document (workbook or dashboard) and QUERY_EXECUTION
are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a QUERY_CONTEXT
event but may not be a corresponding QUERY_EXECUTION
event as cache hits do not trigger a query execution.
jobId
The corresponding query jobID in the given warehouse where the query is executed
message
The detail passed from the infra back to the user if applicable
omniQueryID
A uuid for the query being executed within Omni used to track for query killing
organizationID
A unique identifier for your organization within Omni
query
The query that was executed
traceID
A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT
or DASHBOARD_DOWNLOAD
event to the QUERY_EXECUTION
events it ran.
Dashboard Download log field definitions
documentIdentifier
The unique ID of your workbook or dashboard within Omni found within the URL for that document
event
The name of the audit log event. DASHBOARD_DOWNLOAD
is the event that occurs when a user downloads a full dashboard and QUERY_EXECUTION
are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a DASHBOARD_DOWNLOAD
event but may not be a corresponding QUERY_EXECUTION
event as cache hits do not trigger a query execution.
message
Additional detail passed from the log to the user such as the query being executed if applicable
organizationID
A unique identifier for your organization within Omni
organizationUserID
This unique identifier for a given user within Omni and can be used to look up a user at https://<your-environment>.omniapp.co/users
.
timestamp
When the event occurred
traceID
A uuid for tracing the event across the logs, e.g. from a QUERY_CONTEXT
or DASHBOARD_DOWNLOAD
event to the QUERY_EXECUTION
events it ran.
url
The URL of the request where the event occurred
embedEntity
Returns whatever is in the entity field in the embed URL that is generated for that user if applicable