Audit Logging

This page describes how Rockset provides visibility into your account through the notion of events – which are stored as documents in a special collection called _events – and comprehensive audit logs that we can provide to you on request.

The _events Collection

The _events collection is created when your organization is initialized and cannot be deleted. All events exist in the _events collection as documents containing the following fields:

• _id - a unique event identifer
• _event_time - the time at which the event occurred, in milliseconds after January 1, 1970 (UTC).
• label - one of the labels listed in the table below
• kind - can be API_KEY, COLLECTION, INGEST, INTEGRATION, ORGANIZATION, QUERY, or USER. Note that events in the QUERY category only apply to queries made from the Rockset Console, and does not include events from queries made via API calls.
• type - can be INFO, WARNING, ERROR, or DEBUG

Events may also have additional fields depending on the specific event. All supported events are listed in the table below, as well as additional fields for each event label:

Audit Logs

Rockset also maintains comprehensive, searchable, and exportable audit logs of all security-related events including authentication, permissions changes, CRUD operations, assumptions of privileges, and more. This feature is not yet generally available. To request early access, please contact support@rockset.com.