Databricks Audit Logs, What is "dataSourceId"?

Question

Hi,

 

I want to access the Databricks Audit Logs to check user activity.

 

I created a Databricks workspace on the premium pricing tier.

I configured Audit logs to be sent to Azure Diagnostic log delivery. What I got in the "Log Analytics Workspace":

I have two questions.

1. What is the difference between "DatabricksSQL" & "DatabricksDatabricksSQL"?
2. When I open "DatabricksSQL" or "DatabricksDatabricksSQL", and select "executeFastQuery" & "executeAdhocQuery" for ActionName:

I get "dataSourceId" in the column "Requestparams".

I was wondering what "dataSourceId" is. Is it the TableID or CatalogID?

Answer 1

@Mohammad Saber Thanks for the question and using MS Q&A platform.

What is the difference between "DatabricksSQL" & "DatabricksDatabricksSQL"?

As per the repro both DatabricksSQL and DatabricksDatabricksSQL gives the same results. Why it has named differently - I had raised a concern with the internal team to get more information on the naming convention.

DatabricksSQL - Audit logs for events related to creation, modification etc. of Databricks SQL endpoints.

DatabricksDatabricksSQL - Databricks databrickssql audit logs.

What is "dataSourceId"?

data_source_id is an another identifier of the SQL Endpoint. It's not the same as the SQL endpoint ID that is used for operations on SQL Endpoint.

The data_sourceid field specifies the id of the SQL warehouse against which this query will run.

Example: I had two sql waarehouses named Test with dataSourceId: 0cd* and chepra with dataSourceId:2d7* - when a run any query with SQL warehouse named Test - it will return dataSourceId:0cd*.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.