---
type: concept
x-llmwiki:
  schemaVersion: "0.1"
  contentHash: 00fd5b4587db517aad13293a874e233d5da9c56c100d4a1fc174188adcb535c4
  pageDirectory: concepts
  sources:
    - audit-and-monitor-data-sharing-databricks-on-aws.md
  confidence: 0.98
  provenanceState: extracted
  freshnessStatus: unverified
  aliases:
    - system-tables-for-audit-logs
    - STFAL
    - System tables (access lineage)
  citations:
    - file: audit-and-monitor-data-sharing-databricks-on-aws.md
title: System Tables for Audit Logs
description: The system.access.audit table where audit logs are stored when system tables are enabled, requiring account admin or granted permissions to read
tags:
  - delta-sharing
  - audit-logging
  - system-tables
timestamp: "2026-06-19T14:05:11.582Z"
---

# System Tables for Audit Logs

**System Tables for Audit Logs** refers to the Databricks feature that stores audit log events in a system‑managed database, accessible via the table `system.access.audit`. This table provides a queryable, centralized repository of account‑level audit events, including those generated by [OpenSharing](/concepts/opensharing.md) and other Databricks services. ^[audit-and-monitor-data-sharing-databricks-on-aws.md]

## Requirements

To access audit logs through system tables, an account admin must first enable the audit log system table for the Databricks account. This is done via the "Enable system tables" procedure in the account settings. After enablement, the audit logs are written to `system.access.audit`. ^[audit-and-monitor-data-sharing-databricks-on-aws.md]

## Accessing the Audit Log System Table

Users who are not account admins or [Metastore](/concepts/metastore.md) admins must be granted explicit access to read from `system.access.audit`. Granting `SELECT` on this table to a user or service principal allows them to query the log data. ^[audit-and-monitor-data-sharing-databricks-on-aws.md]

If the account instead uses an audit log delivery setup, logs are written to a configured bucket and path rather than to the system table. Administrators should check which delivery method is in use for their account. ^[audit-and-monitor-data-sharing-databricks-on-aws.md]

## Viewing Events

The audit log system table captures events from multiple sources. For [OpenSharing](/concepts/opensharing.md), logged events include:

- `deltaSharingQueriedTableChanges`
- `deltaSharingQueriedTable`
- `generateTemporaryTableCredentials`
- `generateTemporaryVolumeCredentials`

Detailed response fields and error messages are available in the `response.result` or `request_params` columns of the log entries. For a complete list of OpenSharing events, see the [OpenSharing events documentation](https://docs.databricks.com/aws/en/admin/account-settings/audit-logs#ds). ^[audit-and-monitor-data-sharing-databricks-on-aws.md]

## Related Concepts

- Audit log delivery – An alternative method of exporting audit logs to cloud storage.
- [OpenSharing](/concepts/opensharing.md) – Delta Sharing protocol that generates many of the events recorded in the audit log.
- [Unity Catalog Metastore](/concepts/unity-catalog-metastore.md) – The [Metastore](/concepts/metastore.md) that controls access to audit log tables.
- System tables – The broader feature set of system‑managed tables for account observability.

## Sources

- audit-and-monitor-data-sharing-databricks-on-aws.md

# Citations

1. [audit-and-monitor-data-sharing-databricks-on-aws.md](/references/audit-and-monitor-data-sharing-databricks-on-aws-b723cd40.md)
