Docs

Lake AI Service

Data security and auditing

Audit logs

The LAS metadata management feature supports enabling the audit log function. Once enabled, metadata management operation events will be automatically written to the VolcanoEngineLog Service product (TLS), making it easier to perform retrospective audits of these operations. This document introduces the key points and core operational guidance for auditing operations in the LAS metadata management feature.

Cautions and limitations

Only users with the LASAIFullAccess permission are authorized to perform LAS Catalog audit log-related operations. If you do not have the required permissions, contact the administrator to add the corresponding permissions for you.
The Iceberg Rest Catalog currently does not support the audit log feature.
The LAS Catalog audit log records operations involving metadata changes. Data changes or engine-side changes are not recorded.

Preparation: Enable TLS and grant authorization

The audit log feature of LAS metadata management depends on the VolcanoEngineLog Service product (TLS). Therefore, you need to enable the TLS product first. For an introduction to TLS, see the TLS official documentation .
warning
- The audit log feature requires you to enable the TLS service and authorize ServiceForTLS. LAS will create the TLSCrossAccountTransformationForLAS role for TLS log delivery. Modifying this role will make the audit log service unavailable.
- After enabling the log audit feature, subsequent events written to TLS will incur TLS usage fees. These fees will be included in the TLS billing statement. For billing details, see TLS Billing Documentation .
When writing LAS metadata management-related operation logs to TLS, you need to perform cross-service authorization (ServiceForTLS) for TLS to allow LAS to deliver logs to TLS.
1. You can go to the Data Processing > Data Transformation page in TLS and click the Create Data Transformation Task button to trigger cross-service authorization.
2. When prompted for authorization on the interface, complete the authorization as instructed. You do not need to continue with the task creation operation on the page. After authorization is complete, you can exit the page.

After completing the above preparations, you can enable the audit log switch on the LAS metadata management page to deliver logs to TLS.

Enable or disable the audit log switch

After logging in to the LAS console, on the Lake management > Metadata page, you can choose to enable or disable the audit log switch.

After enabling the switch, you can then click the TLS Log Service Go to button to go to the TLS console page and view log details.
After turning off the switch, log delivery to TLS will stop. Previously delivered log data will remain and will not be deleted, and configurations such as topics will also be retained.

After turning on the switch, you can go to the TLS console and IAM console to check the relevant log delivery features to ensure that logs can be delivered to TLS normally.
1. Click the TLS Log Service button to go to the TLS console page. On the "Log Projects" page, you will see that LAS has created a new project named "las-audit-project" for you. Subsequent LAS Catalog-related logs will be delivered to this project.
  tip
  - To view and confirm the "las-audit-project" project in the TLS Console, you need to ensure that you have permission to view log projects in the TLS Console.
  - If the "las-audit-project" project already exists in your TLS projects, LAS will deliver logs to this project. If this project does not exist, LAS will create it for you.
2. After entering the IAM console, on the role management page, you will see that LAS has automatically created the "TLSCrossAccountTransformationForLAS" role for you and configured the log delivery permissions for this role. LAS will use this role to deliver logs to TLS going forward. Please make sure not to modify or delete the corresponding role to avoid log delivery failures due to permission issues.

View log details

After enabling the audit log switch, you can view detailed log information only on the TLS page.

tip

To view log details in the TLS Console, ensure that your operating account has at least the permissions to view log projects and log details in the TLS Console.

On the LAS metadata management page, click the TLS Log Service button to go to the TLS console page.
On the Overview page of the TLS console, you can search for the "las-audit-project" project. All log data from LAS metadata management will be delivered to this project.

After clicking the "las-audit-project" project to enter the project details page, you can view all log information.

The following is an example of an audit log record. The key fields included in each audit log and their descriptions are as follows.

{
  "request_id": "string",       // Unique request identifier, associates multiple events within a single request
  "account_id": "string",       // Tenant/account ID (primary account)
  "user_id": "string",          // User ID (sub-account or actual operator)
  "event_time": "timestamp",    // Event occurrence time (UTC, ISO 8601 format, for example, "2023-01-01T01:01:01.123Z")
  "service_name": "string",     // Service module name, fixed as "las_catalog"
  "event_name": "string",       // Operation name (event type), for example, "CreateTable"
  "identifier": "string",       // Unique identifier of the operation object, for example, "my_db.my_table"
  "response": {                 // Response status
    "statusCode": "integer",    // HTTP status code or internal business status code
    "errorMessage": "string"  // Error message, null if successful
  },
  "detail": "string",           // Operation details (JSON stringified), contains key parameters of the request
  "event_date": "string",       // Event partition date (YYYY-MM-DD), used for partitioning
  "schema_version": "string"    // Audit log schema version, for example, "1.0"
}

Field name	Data type	Core meaning	Example value/Description
`request_id`	`STRING`	Unique request identifier	`"ServiceMain-4529754264"` (associates multiple events within a single request)
`account_id`	`BIGINT`	Tenant/account ID	Primary account
`user_id`	`BIGINT`	User ID	Sub-account ID
`event_time`	`TIMESTAMP`	Event occurrence time (UTC)	`"2023-01-01T01:01:01.123Z"` (always use UTC)
`service_name`	`STRING`	Service module name	`"las_catalog"`
`event_name`	`STRING`	Operation name (event type)	`"GetTable"`, `"GrantPermission"`, `"CreateBranch"`
`response`	`STRUCT<statusCode: INT, errorMessage: STRING>`	Response status	`{"statusCode": 200, "errorMessage": null}` (does not contain sensitive results)
`identifier`	`STRING`	Unique identifier of the operation object	You can use the `identifier` field to determine the log event type corresponding to the current log. The supported log event types are as follows. catalog: Catalog-level operation logs. database: Database-level operation logs. table: Table-level operation logs. permission: Operation logs related to permission management. view: View-level operation logs. function: Function-level operation logs. other: Logs of other log event types.
`schema_version`	`STRING`	Audit log schema version	`"1.0"`
`event_date`	`DATE`	Event partition date	`"2023-01-01"` (used for partitioning)
`detail`	`STRING`	Detailed operation description

Reference: Supported log event list

Event type: catalog

event_name	event description
`CreateCatalog`	Create Catalog
`AlterCatalog`	Modify Catalog
`GetCatalog`	Get Catalog
`GetCatalogs`	Get Catalogs
`DropCatalog`	Delete Catalog

Event type: database

event_name	event description
`CreateDatabase`	Create Database
`GetDatabase`	Get Database
`DropDatabase`	Delete Database
`GetDatabases`	Get Databases
`GetAllDatabases`	Get All Databases
`AlterDatabase`	Modify Database
`GetMetastoreDbUuid`	Get Metastore Db Uuid

Event type: table

event_name	event description
`CreateTable`	Create Table
`CreateTableWithEnvironmentContext`	Create Table With Environment Context
`DropTable`	Delete Table
`DropTableWithEnvironmentContext`	Delete Table With Environment Context
`GetTable`	Get Table
`GetTables`	Get Tables
`GetAllTables`	Get All Tables
`GetTableObjectsByName`	Get Table Objects By Name
`GetTableNamesByFilter`	Get Table Names By Filter
`AlterTable`	Modify Table
`AlterTableWithEnvironmentContext`	Modify Table With Environment Context
`UpdateTableColumnStatistics`	Update Table Column Statistics
`GetTableColumnStatistics`	Get Table Column Statistics
`GetTableStatisticsReq`	Get Table Statistics Req
`DeleteTableColumnStatistics`	Delete Table Column Statistics
`AlterTableWithCascade`	Modify Table With Cascade
`CreateTableWithConstraints`	Create Table With Constraints
`TruncateTable`	Truncate Table
`GetTablesByType`	Get Tables By Type
`GetTableMeta`	Get Table Meta
`GetTableReq`	Get Table Req
`GetTableObjectsByNameReq`	Get Table Objects By Name Req
`AllocateTableWriteIds`	Allocate Table Write Ids
`ListTableNames`	List Table Names
`ListTableNameAndUris`	List Table Name And Uris

Event type: permission

event_name	event description
`CreateRole`	Create Role
`DropRole`	Delete Role
`GetRoleNames`	Get Role Names
`GrantRole`	Grant Role
`RevokeRole`	Revoke Role
`ListRoles`	List Roles
`GrantRevokeRole`	Grant/Revoke Role
`GetPrincipalsInRole`	Get Principals In Role
`GetRoleGrantsForPrincipal`	Get Role Grants For Principal
`GetPrivilegeSet`	Get Privilege Set
`ListPrivileges`	List Privileges
`GrantPrivileges`	Grant Privilege
`RevokePrivileges`	Revoke Privilege
`GrantRevokePrivileges`	Grant/Revoke Privilege
`RefreshPrivileges`	Refresh Privileges

Event type: view

event_name	event description
`GetMaterializedViewsForRewriting`	Get Materialized Views For Rewriting

Event type: function

event_name	event description
`CreateFunction`	Create Function
`DropFunction`	Delete Function
`AlterFunction`	Modify Function
`GetFunctions`	Get Functions
`GetFunction`	Get Function
`GetAllFunctions`	Get All Functions
`ListFunctionNames`	List Function Names
`ListFunctionNameAndUris`	List Function Name And Uris

Event type: other

event_name	event description
GetMetaConf	Get Meta Conf
SetMetaConf	Set Meta Conf
GetType	Get Type
CreateType	Create Type
DropType	Delete Type
GetTypeAll	Get Type All
GetFields	Get Fields
GetSchema	Get Schema
AddPartition	Add Partition
AddPartitionWithEnvironmentContext	Add Partition With Environment Context
AddPartitions	Add Partitions
AddPartitionsPspec	Add Partitions Pspec
AppendPartition	Append Partition
AddPartitionsReq	Add Partitions Req
AppendPartitionWithEnvironmentContext	Append Partition With Environment Context
AppendPartitionByName	Append Partition By Name
AppendPartitionByNameWithEnvironmentContext	Append Partition By Name With Environment Context
DropPartition	Delete Partition
DropPartitionWithEnvironmentContext	Delete Partition With Environment Context
DropPartitionByName	Delete Partition By Name
DropPartitionByNameWithEnvironmentContext	Delete Partition By Name With Environment Context
DropPartitionsReq	Delete Partitions Req
GetPartition	Get Partition
ExchangePartition	Exchange Partition
GetPartitionWithAuth	Get Partition With Auth
GetPartitionByName	Get Partition By Name
GetPartitions	Get Partitions
GetPartitionsWithAuth	Get Partitions With Auth
GetPartitionsPspec	Get Partitions Pspec
GetPartitionNames	Get Partition Names
GetPartitionsPs	Get Partitions Ps
GetPartitionsPsWithAuth	Get Partitions Ps With Auth
GetPartitionNamesPs	Get Partition Names Ps
GetPartitionsByFilter	Get Partitions By Filter
GetPartSpecsByFilter	Get Part Specs By Filter
GetPartitionsByExpr	Get Partitions By Expr
GetPartitionsByNames	Get Partitions By Names
AlterPartition	Modify Partition
AlterPartitions	Modify Partitions
AlterPartitionWithEnvironmentContext	Modify Partition With Environment Context
RenamePartition	Rename Partition
PartitionNameHasValidCharacters	Execute Partition Name Has Valid Characters operation
GetConfigValue	Get Config Value
PartitionNameToVals	Execute Partition Name To Vals operation
PartitionNameToSpec	Execute Partition Name To Spec operation
MarkPartitionForEvent	Mark Partition For Event
IsPartitionMarkedForEvent	Judge Partition Marked For Event
UpdatePartitionColumnStatistics	Update Partition Column Statistics
GetPartitionColumnStatistics	Get Partition Column Statistics
GetPartitionsStatisticsReq	Get Partitions Statistics Req
GetAggrStatsFor	Get Aggr Stats For
SetAggrStatsFor	Set Aggr Stats For
DeletePartitionColumnStatistics	Delete Partition Column Statistics
SetUgi	Set Ugi
GetDelegationToken	Get Delegation Token
RenewDelegationToken	Execute Renew Delegation Token operation
CancelDelegationToken	Cancel Delegation Token
GetOpenTxns	Get Open Txns
GetOpenTxnsInfo	Get Open Txns Info
OpenTxns	Open Txns
AbortTxn	Abort Txn
CommitTxn	Commit Txn
Lock	Lock
CheckLock	Check Lock
Unlock	Unlock
ShowLocks	Show Locks
Heartbeat	Send Heartbeat
HeartbeatTxnRange	Send Heartbeat Txn Range
Compact	Compress Data
ShowCompact	Show Compact
AddDynamicPartitions	Add Dynamic Partitions
FireListenerEvent	Trigger Listener Event
GetCurrentNotificationEventId	Get Current Notification Event Id
GetFieldsWithEnvironmentContext	Get Fields With Environment Context
GetNextNotification	Get Next Notification
GetSchemaWithEnvironmentContext	Get Schema With Environment Context
DropConstraint	Delete Constraint
AddPrimaryKey	Add Primary Key
AddForeignKey	Add Foreign Key
AddUniqueConstraint	Add Unique Constraint
AddNotNullConstraint	Add Not Null Constraint
AddDefaultConstraint	Add Default Constraint
AddCheckConstraint	Add Check Constraint
GetMaterializationInvalidationInfo	Get Materialization Invalidation Info
UpdateCreationMetadata	Update Creation Metadata
ExchangePartitions	Exchange Partitions
GetPartitionValues	Get Partition Values
GetNumPartitionsByFilter	Get Num Partitions By Filter
AlterPartitionsWithEnvironmentContext	Modify Partitions With Environment Context
GetPrimaryKeys	Get Primary Keys
GetForeignKeys	Get Foreign Keys
GetUniqueConstraints	Get Unique Constraints
GetNotNullConstraints	Get Not Null Constraints
GetDefaultConstraints	Get Default Constraints
GetCheckConstraints	Get Check Constraints
AddToken	Add Token
RemoveToken	Remove Token
GetToken	Get Token
GetAllTokenIdentifiers	Get All Token Identifiers
AddMasterKey	Add Master Key
UpdateMasterKey	Update Master Key
RemoveMasterKey	Remove Master Key
GetMasterKeys	Get Master Keys
AbortTxns	Abort Txns
ReplTblWriteidState	Execute Repl Tbl Writeid State operation
GetValidWriteIds	Get Valid Write Ids
Compact2	Compress Data
GetNotificationEventsCount	Get Notification Events Count
FlushCache	Execute Flush Cache operation
CmRecycle	Execute Cm Recycle operation
GetFileMetadataByExpr	Get File Metadata By Expr
GetFileMetadata	Get File Metadata
PutFileMetadata	Write File Metadata
ClearFileMetadata	Clean File Metadata
CacheFileMetadata	Cache File Metadata
CreateResourcePlan	Create Resource Plan
GetResourcePlan	Get Resource Plan
GetActiveResourcePlan	Get Active Resource Plan
GetAllResourcePlans	Get All Resource Plans
AlterResourcePlan	Modify Resource Plan
ValidateResourcePlan	Validate Resource Plan
DropResourcePlan	Delete Resource Plan
CreateWmTrigger	Create Wm Trigger
AlterWmTrigger	Modify Wm Trigger
DropWmTrigger	Delete Wm Trigger
GetTriggersForResourceplan	Get Triggers For Resourceplan
CreateWmPool	Create Wm Pool
AlterWmPool	Modify Wm Pool
DropWmPool	Delete Wm Pool
CreateOrUpdateWmMapping	Create Or Update Wm Mapping
DropWmMapping	Delete Wm Mapping
CreateOrDropWmTriggerToPoolMapping	Create Or Drop Wm Trigger To Pool Mapping
CreateIschema	Create Ischema
AlterIschema	Modify Ischema
GetIschema	Get Ischema
DropIschema	Delete Ischema
AddSchemaVersion	Add Schema Version
GetSchemaVersion	Get Schema Version
GetSchemaLatestVersion	Get Schema Latest Version
GetSchemaAllVersions	Get Schema All Versions
DropSchemaVersion	Delete Schema Version
GetSchemasByCols	Get Schemas By Cols
MapSchemaVersionToSerde	Map Schema Version To Serde
SetSchemaVersionState	Set Schema Version State
AddSerde	Add Serde
GetSerde	Get Serde
GetLockMaterializationRebuild	Get Lock Materialization Rebuild
HeartbeatLockMaterializationRebuild	Send Heartbeat Lock Materialization Rebuild
AddRuntimeStats	Add Runtime Stats
GetRuntimeStats	Get Runtime Stats
ListVolumes	List Volumes
ListVolumeNames	List Volume Names
GetVolume	Get Volume
CreateVolume	Create Volume
AlterVolume	Modify Volume
DropVolume	Delete Volume
GetVolumeCredentials	Get Volume Credentials
ListOperators	List Operators
ListOperatorNames	List Operator Names
GetOperator	Get Operator
UpsertOperator	Merge Write Operator
CreateOperator	Create Operator
AlterOperator	Modify Operator
BatchUpsertOperators	Execute Batch Upsert Operators operation
DropOperator	Delete Operator
ListVolumeNameAndUris	List Volume Name And Uris
ListOperatorNameAndUris	List Operator Name And Uris
GetDataVersion	Get Data Version
CreateDataVersion	Create Data Version
UpdateDataVersion	Update Data Version
DeleteDataVersion	Delete Data Version
GetOptimizer	Get Optimizer
CreateOptimizer	Create Optimizer
UpdateOptimizer	Update Optimizer
DeleteOptimizer	Delete Optimizer
RunOptimizerTask	Run Optimizer Task
CancelOptimizerTask	Cancel Optimizer Task
ListOptimizerTasks	List Optimizer Tasks
GetOptimizerTask	Get Optimizer Task
CreateOptimizerTask	Create Optimizer Task
UpdateOptimizerTask	Update Optimizer Task
DeleteOptimizerTask	Delete Optimizer Task
GetOptimizerConfigOptions	Get Optimizer Config Options

Last updated: 2026.05.20 18:20:27