Query Audit Logs

Query audit logs enable ALTR administrators to when and by whom data was accessed from the ALTR platform. The logs show all query audit log entries with details on what database objects were impacted by the query log. The log by default displays the last 24 hours of activity.

Query audit log entries are available in near-real time, typically seconds or minutes after a query is complete and all required information regarding that query is available in the connected data source. To see log entries from the last 24 hours, navigate to the Query Log page and click Refresh.

ALTR provides the following query audit logs:

Cloud Integrations

When a user or application runs a query on an ALTR-connected column or tag in cloud platforms like Snowflake, ALTR logs key details, including who ran the query, what sensitive data was accessed, how much was accessed, and which access policies have been applied. The log details vary based on the query type and data source.

Caution

For Snowflake data sources, ALTR’s service user must have the MONITOR grant for the warehouse used to execute the query; otherwise, a query audit log entry will not be generated.

Sidecars

If using sidecar integration to access OLTP repositories through impersonation policy, ALTR logs key details including data consumers who access the repository, the repository that was access and when the database was accessed. ALTR logs both SQL commands themselves as well as when data consumers authenticated through the sidecar.

Redaction of Sensitive Data

ALTR redacts any potentially sensitive data from query audit log entries to protect sensitive information, such as name and SSN. This ensures that logs remain useful while ensuring the privacy of sensitive data.

• Strings are replaced with 'literal_string'
• Integers are replaced with a randomly generated number (0-9)

View the Query Audit Log

Once a query is executed, log entries take a few seconds to display in the query audit log. Click Refresh to pick up new query audit log entries.

Expand a log entry to view additional information, including the ability to view the raw JSON object. While a lot of useful information displays in the log entry, the raw JSON object shows the complete log details.

View Cloud Integrations Audit Log

To view the cloud integrations audit log, click Audit Logs in the Navigation menu or view it in ALTR’s Amazon S3 Log Export .

Copy Query ID or Query Text

It may be helpful to copy the full query text or the query ID (which is the Snowflake query ID) if you need to

• find the query in Snowflake
• contact ALTR Support because you have an issue with a query

To copy the query ID or query text:

1. Select Audit Logs in the Navigation menu.
2. Locate the query log entry.
3. Click Query Text or Query ID ; a pop-up modal displays to reveal the full query text / query ID.
4. Click Copy .

View Sidecars Audit Log

To view the sidecars audit log:

1. Click Audit Logs in the Navigation menu.
2. Select Sidecars from the Audit Log dropdown.

Filter the Query Audit Log

Click Filter on the query log to filter log entries in order to locate an entry or set of entries. Filters are case-insensitive and use exact matching.

When filtering:

• use one value per filter
• a time window is required. By default, the Completion Before date is set to the current date and the Completion After date is set to 7 days from the current date