Audit Event Reference

This reference documents the audit_log table schema and field descriptions. For audit sources and query workflows, see Audit Logging.

Audit Log Table

Database audit records are stored in the audit_log table in the __internal_schema database.

Column name	Type	Description
query_id	varchar(48)	ID of the query.
time	datetime(3)	Time when the query was executed, in milliseconds.
client_ip	varchar(128)	IP address of the client sending the query.
user	varchar(128)	User.
catalog	varchar(128)	Current catalog during statement execution.
db	varchar(128)	Current database during statement execution.
state	varchar(128)	Execution status of the statement.
error_code	int	Error code.
error_message	text	Error message.
query_time	bigint	Execution time of the statement.
scan_bytes	bigint	Amount of data scanned.
scan_rows	bigint	Number of rows scanned.
return_rows	bigint	Number of rows returned.
shuffleSendRows	bigint	Number of rows transferred between nodes during statement execution. Supported since version 3.0.
shuffleSendBytes	bigint	Amount of data transferred between nodes during statement execution. Supported since version 3.0.
scanBytesFromLocalStorage	bigint	Amount of data read from local disk. Supported since version 3.0.
scanBytesFromRemoteStorage	bigint	Amount of data read from remote storage. Supported since version 3.0.
stmt_id	bigint	Statement ID.
stmt_type	string	Statement type. Supported since version 3.0.
is_query	tinyint	Whether the statement is a query.
is_nereids	boolean	Whether the statement uses the Nereids optimizer.
frontend_ip	varchar(128)	IP address of the connected Frontend.
cpu_time_ms	bigint	Cumulative Backend CPU time consumed by statement execution, in milliseconds.
sql_hash	varchar(128)	Hash value of the statement.
sql_digest	varchar(128)	Digest or signature of the statement.
peak_memory_bytes	bigint	Peak Backend memory usage during statement execution.
workload_group	text	Workload group used for statement execution.
compute_group	string	Compute group used by the executed statement in storage-compute separation mode. Supported since version 3.0.
trace_id	string	Trace ID set when executing the statement. Removed since version 3.0.3.
stmt	text	Statement text.

Field Notes

• client_ip: If a proxy service is used and IP pass-through is not enabled, this field may record the proxy service IP instead of the real client IP.
• state: EOF indicates that the query executed successfully. OK indicates that the DDL or DML statement executed successfully. ERR indicates that statement execution failed.

Related Documentation

• Audit Logging
• audit_log system table
• Log Explorer