Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.

Structured Data Audit (Trino)

The Structured Data Audit view answers one forensic question about your Trino query engine: who ran what SQL against which catalog, schema, and table, and what did the query read, write, or delete? It is the structured-data (SQL and RDBMS) counterpart of the file and object audit in File Activity. Like File Activity, it is read-only and never modifies data.

Where: Data Auditing > Trino

Overview​

The Superna Trino event-listener plugin records every completed Trino query and sends it to the console. The console stores one row for each table that a query accessed. Each row captures:

  • The user.
  • The catalog, schema, and table.
  • The operation (read, write, or delete).
  • The query type (SELECT, INSERT, UPDATE, DELETE, MERGE, CREATE, DROP, ALTER, and so on).
  • The bytes and rows touched, and the wall and CPU time.
  • The query state (FINISHED or FAILED).
  • The client IP address and the cluster.
  • The full SQL text.

Results include only events that are fully ingested. Filters are combined with AND, so each additional filter narrows the results.

Views​

The page offers two views of the same data.

Table changes by user​

This is the landing view. It groups activity by user, table, and operation over the selected time window. Each row shows:

  • The query count.
  • Rows changed — the sum of written and updated rows.
  • Bytes.
  • The number of distinct queries.
  • The client IP addresses that the queries came from, separated by commas. A dash (—) means that none were recorded.
  • When the activity was last seen.

The view shows which users changed which tables, from where, and by how much. Click a row to open the row-level browser, filtered to that user, table, and operation.

Row-level query browser​

This is the forensic drill-down, with one row for each table access. The columns are:

  • Event Time
  • Trino User
  • Operation (badge)
  • Query Type
  • Catalog / Schema / Table (breadcrumb)
  • Rows
  • Bytes
  • Wall ms
  • State
  • Client IP
  • Cluster

The full SQL is not shown in the grid. Open the row flyout to see it. The flyout also shows the query ID, the CPU and wall time, the error type and code, and the raw authentication principal.

The SQL is stored in full and shown without redaction to operators who have audit access.

Operations and DML/DDL​

Two classifications describe each query, and both come from the recorded query.

  • Operation — read (SELECT), write (INSERT, UPDATE, MERGE), or delete (DELETE). The Table changes by user view groups by this value.
  • DML or DDL — derived from the query type. DDL is schema changes (CREATE, DROP, ALTER). DML is data changes (SELECT, INSERT, UPDATE, DELETE, MERGE). One-click filters isolate schema changes (DDL) or data changes (DML).

The user shown​

The Trino User column shows one canonical user. It uses the Trino user when one is present, and the authentication principal otherwise. Unauthenticated Trino clients record their identity in the principal field instead of the user field, so combining both gives one consistent "who".

The user filter matches either value. The row flyout always shows the raw principal separately.

Filters​

Leave a filter unset to match everything.

FilterDescription
Time rangeFrom and to timestamps. Events outside the window are excluded.
Trino UserMatches the canonical user (Trino user or principal).
CatalogThe Trino catalog, for example hive or iceberg.
SchemaThe schema within the catalog.
Table containsSubstring match on the table name.
Query TypeSELECT, INSERT, UPDATE, DELETE, MERGE, CREATE, DROP, ALTER, and so on.
Operationread, write, or delete.
DML / DDLData changes or schema changes.
ClusterThe Trino cluster that ran the query.
Query StateFINISHED or FAILED. Failed queries are kept for forensics.
Query text containsSubstring search over the stored SQL.

Workflows​

Find who changed a sensitive table​

  1. Switch the Data Auditing view to Trino. The Table changes by user view opens.
  2. Set the time window and enter the table name in Table contains.
  3. Read each user, operation, and rows-changed value.
  4. Click a row to open the individual queries, and read the full SQL in the flyout.

Find every schema change in a time window​

  1. In the Trino view, open the Row-level query browser.
  2. Set the time window and click the schema changes (DDL) filter.
  3. Each row shows who ran the CREATE, DROP, or ALTER statement and against which table. Open the flyout for the full statement.

Tips​

  • Trino audit rows are kept for 12 months. Older rows expire automatically and no longer appear.
  • A query that touches several tables produces several rows, one for each accessed table. Counts in the summary strip show table accesses, not distinct queries. Use the distinct queries column in the rollup for the query count.
  • The updated-rows value is always 0, because Trino does not report a count of updated rows. Rows affected by MERGE and UPDATE queries are counted in the written rows.
  • If the view is empty, confirm that the Trino plugin is installed and that the coordinator was restarted. See Trino Audit settings. Audit rows flow only after the listener loads.