Audit Log

Casabase Cube maintains an application-level audit log of significant administrative and data-access activity.

Audit records capture information such as:

• Who performed an operation
• What operation occurred
• When it occurred
• Which cube or object was affected
• Whether the operation succeeded or failed
• Execution time
• Rows processed where applicable
• Event-specific details

The audit log is maintained inside the Casabase Cube Native Application in the customer’s Snowflake account.

Audit Log Access

Audit administration requires the CUBE_ADMIN application role.

CUBE_ADMIN includes administrative capabilities such as managing dimensions, formulas, security, schedules, and reading the audit log.

Exporting Audit History

Use:

CALL CUBE.EXPORT_AUDIT_LOG(
    p_start_date => '2026-08-01'::TIMESTAMP_LTZ,
    p_end_date   => '2026-08-31'::TIMESTAMP_LTZ,
    p_event_type => NULL,
    p_cube_name  => 'FINANCE',
    p_limit      => 1000
);

All filters are optional.

Pass NULL to widen a filter.

For example, to retrieve recent upgrade events:

CALL CUBE.EXPORT_AUDIT_LOG(
    NULL,
    NULL,
    'APP_UPGRADE',
    NULL,
    50
);

EXPORT_AUDIT_LOG returns:

Column	Description
ID	Audit record identifier
EVENT_TYPE	Type of application event
USER_NAME	Snowflake user associated with the operation
ROLE_NAME	Role associated with the operation
ACTION	Action performed
OBJECT_TYPE	Type of object affected
OBJECT_NAME	Name of the affected object
CUBE_NAME	Cube associated with the event
DETAILS	Event-specific JSON context
EXECUTION_TIME_MS	Execution duration in milliseconds
ROW_COUNT	Rows processed where applicable
STATUS	Operation outcome
ERROR_MESSAGE	Error information when the operation failed
SESSION_ID	Snowflake session identifier
CREATED_AT	Event timestamp

The DETAILS field contains event-specific context. For example, an application-upgrade event can contain previous and new version information, while a scheduled-query event can include information about its target and result.

Activity Summary

For a summarized view of recent audit activity, use:

CALL CUBE.GET_AUDIT_SUMMARY(30);

The argument specifies the number of days to review.

The summary returns information by event type, including:

Column	Description
EVENT_COUNT	Total number of events
SUCCESS_COUNT	Successful events
ERROR_COUNT	Failed events
AVG_EXECUTION_MS	Average execution duration
TOTAL_ROWS_PROCESSED	Total rows processed
UNIQUE_USERS	Number of distinct users
FIRST_EVENT	Earliest event in the period
LAST_EVENT	Most recent event in the period

This is useful for identifying developing operational issues such as increasing error counts or changes in execution duration.

What Gets Recorded

Audit events cover the major functional areas of Casabase Cube.

Examples include:

Application
    APP_INSTALL
    APP_UPGRADE
    UPGRADE_MIGRATION

Dimensions
    DIMENSION_CREATE
    DIMENSION_REBUILD
    DIMENSION_VIEW
    DIMENSION_SNAPSHOT
    ATTR_BUILD_ASYNC

Data
    DATA_IMPORT
    LOAD_DATA
    FACT_RESORT
    FACT_SECURE_VIEW

Queries and Scheduling
    DATA_QUERY
    SCHEDULED_QUERY

Cube Lifecycle and Configuration
    CUBE_CLONE
    TABLE_DROP
    CONFIG_CHANGE
    PROFILE_DERIVE

Formula, security, and other administrative operations are also represented in the audit history.

Audit event names can evolve as the application evolves.

Historical Event Names

Audit records from earlier application versions are preserved rather than rewritten.

For example, older versions can contain:

HIERARCHY_CREATE
HIERARCHY_REBUILD
HIERARCHY_VIEW

where newer versions use:

DIMENSION_CREATE
DIMENSION_REBUILD
DIMENSION_VIEW

When reporting across application upgrades, include both names where appropriate.

For example:

SELECT
    EVENT_TYPE,
    COUNT(*) AS events
FROM CASABASE_CUBE.CONFIG.AUDIT_LOG
WHERE EVENT_TYPE IN (
    'DIMENSION_CREATE',
    'HIERARCHY_CREATE'
)
GROUP BY EVENT_TYPE;

Existing historical rows are intentionally not renamed during an upgrade.

Reviewing Failures

A useful operational query is to identify recent failed events:

SELECT
    CREATED_AT,
    EVENT_TYPE,
    USER_NAME,
    CUBE_NAME,
    ERROR_MESSAGE
FROM CASABASE_CUBE.CONFIG.AUDIT_LOG
WHERE STATUS <> 'SUCCESS'
  AND CREATED_AT > DATEADD(
        'day',
        -7,
        CURRENT_TIMESTAMP()
      )
ORDER BY CREATED_AT DESC;

This can help identify problems involving:

• Dimension rebuilds
• Scheduled queries
• Data operations
• Application upgrades
• Configuration operations
• Other administrative activity

Reviewing Query Activity

DATA_QUERY events provide visibility into cube usage.

For example:

SELECT
    CUBE_NAME,
    USER_NAME,
    COUNT(*) AS queries,
    MAX(CREATED_AT) AS last_query
FROM CASABASE_CUBE.CONFIG.AUDIT_LOG
WHERE EVENT_TYPE = 'DATA_QUERY'
  AND CREATED_AT > DATEADD(
        'day',
        -30,
        CURRENT_TIMESTAMP()
      )
GROUP BY
    CUBE_NAME,
    USER_NAME
ORDER BY queries DESC;

This can help answer:

Who is querying this cube?
How frequently?
When did they last query it?

Audit Log and Row-Level Security

Query auditing is especially important because Casabase Cube row-level security is opt-in per user.

A user with application access but no active security rules is unrestricted by Casabase Cube row-level security.

This means administrators should periodically compare:

Users Querying the Cube
        │
        ▼
Active Security Rules
        │
        ▼
Expected Security Scope

A user querying a secured cube without an active rule can be:

Intentionally Unrestricted

or:

Missing a Required Security Rule

The audit log provides the query history needed to make that distinction.

See Access Control for the complete security model.

Reviewing Configuration Changes

To review configuration changes:

SELECT
    CREATED_AT,
    USER_NAME,
    CUBE_NAME,
    ACTION,
    OBJECT_NAME,
    DETAILS
FROM CASABASE_CUBE.CONFIG.AUDIT_LOG
WHERE EVENT_TYPE = 'CONFIG_CHANGE'
ORDER BY CREATED_AT DESC;

This can help correlate an unexpected behavior change with recent administration.

A useful troubleshooting workflow is:

Unexpected Behavior
        │
        ▼
Review Current Configuration
        │
        ▼
Review Recent Audit Events
        │
        ▼
Identify Relevant Change
        │
        ▼
Validate or Correct

Application Upgrade History

Application upgrades are recorded through events such as:

APP_UPGRADE
UPGRADE_MIGRATION

To review upgrade history:

CALL CUBE.EXPORT_AUDIT_LOG(
    NULL,
    NULL,
    'APP_UPGRADE',
    NULL,
    50
);

For APP_UPGRADE, DETAILS can contain:

{
  "previous_version": "...",
  "new_version": "..."
}

Upgrade migrations are also recorded because individual cube migrations can require follow-up even when the overall application upgrade completes successfully.

See Application Upgrades.

Scheduled Query Monitoring

Scheduled Saved Query activity is auditable.

This provides history for operations such as:

Scheduled execution
Result-table refresh
Failure
Execution duration
Rows processed

Audit information can therefore be used alongside:

CALL CUBE.LIST_SAVED_QUERY_SCHEDULES(NULL);

when troubleshooting scheduled materialization.

See Saved Queries.

Retention

Casabase Cube audit history continues to grow until older records are explicitly removed.

Retention should therefore be managed according to the organization’s operational, security, governance, and compliance requirements.

Purging Audit History

Use:

CALL CUBE.PURGE_AUDIT_LOG(
    365,
    FALSE
);

to perform a dry run.

With the confirmation argument set to FALSE, the procedure reports what would be removed without deleting anything.

For example:

Would delete N records older than 365 days

After reviewing the result, execute the purge with:

CALL CUBE.PURGE_AUDIT_LOG(
    365,
    TRUE
);

The procedure is deliberately guarded so administrators can preview the effect before deleting historical records.

Export Before Purging

If historical audit information must be retained outside the application, export it before purging.

For example:

CALL CUBE.EXPORT_AUDIT_LOG(
    NULL,
    '2025-08-01'::TIMESTAMP_LTZ,
    NULL,
    NULL,
    1000000
);

The returned records can then be persisted to a customer-controlled archive before older application records are removed.

Conceptually:

Application Audit Log
        │
        ▼
Export Required History
        │
        ▼
Customer Archive
        │
        ▼
Purge Older Application Records

Audit History Across Upgrades

Audit history persists across application upgrades.

Application code can be replaced and internal structures migrated, while customer-specific information such as:

• Cubes
• Dimensions
• Formulas
• Data
• Security rules
• Audit history

This is why historical audit events can span multiple Casabase Cube versions.

Compliance and Privacy

Audit history is also incorporated into Casabase Cube governance reporting.

For example:

CALL CUBE.GET_PRIVACY_REPORT();

includes information about:

• Audit record count
• Span of retained audit history
• Classification coverage
• Security coverage
• Governance recommendations

Audit data can therefore provide supporting evidence for broader organizational compliance and governance reviews.

See Compliance and Privacy.

Audit Log vs. Snowflake Monitoring

Casabase Cube audit history complements Snowflake’s platform-level monitoring.

Conceptually:

Snowflake
│
├── Authentication
├── Session Activity
├── Query History
├── Role Activity
└── Platform Operations
        │
        ▼
Casabase Cube
│
├── Data Queries
├── Dimension Operations
├── Formula Operations
├── Security Operations
├── Saved Query Operations
├── Configuration Changes
└── Application Lifecycle

During an investigation, both sources can provide useful context.

Casabase Cube provides the application-level meaning of operations performed within the Native App.

Audit Log and Provider Telemetry

The Casabase Cube audit log remains inside the customer’s Snowflake environment.

It should not be confused with external vendor telemetry.

Casabase Cube reports its data-handling posture as:

data_egress           NONE
external_connections  NONE
pii_collection        NONE
telemetry              DISABLED

Application activity remains inside the customer’s Snowflake account rather than being sent to a provider-hosted telemetry system.

Recommended Review Workflow

A practical recurring audit review is:

GET_AUDIT_SUMMARY
       │
       ▼
Review Error Counts
       │
       ▼
Investigate Failures
       │
       ▼
Review Significant Changes
       │
       ▼
Review Query Activity
       │
       ▼
Review Security Exceptions
       │
       ▼
Export Evidence if Required

For a specific incident:

Identify Time Window
       │
       ▼
EXPORT_AUDIT_LOG
       │
       ▼
Filter Relevant Event Types
       │
       ▼
Identify User / Object / Cube
       │
       ▼
Review DETAILS and Outcome
       │
       ▼
Compare Current Configuration

Recommended Practices

When administering the audit log:

• Use GET_AUDIT_SUMMARY for routine operational review.
• Review recent failures and increasing error counts.
• Use EXPORT_AUDIT_LOG for detailed investigations and evidence collection.
• Review DATA_QUERY events when validating user access.
• Include users without active security rules in access reviews.
• Correlate configuration changes with unexpected behavior.
• Review upgrade and migration events after application upgrades.
• Establish an audit-retention period that matches organizational policy.
• Always use the dry-run option before purging audit records.
• Export required historical evidence before purging.
• Account for historical event names when reporting across application versions.
• Correlate Casabase Cube audit information with Snowflake monitoring when broader platform context is required.

Key Procedures

EXPORT_AUDIT_LOG(
    start,
    end,
    event_type,
    cube,
    limit
)

GET_AUDIT_SUMMARY(
    days
)

PURGE_AUDIT_LOG(
    retention_days,
    confirm
)

The important purge behavior is:

confirm = FALSE
      │
      ▼
Dry Run Only


confirm = TRUE
      │
      ▼
Delete Matching Historical Records

These are the supported administrative interfaces for reviewing, summarizing, exporting, and retaining Casabase Cube audit history.

Related Topics

• Administration Overview
• Roles and Privileges
• Access Control
• Compliance and Privacy
• Application Upgrades
• Health and Diagnostics
• Operational Tasks
• Logging & Auditability