Crosshire
← Databricks Audit
— Crosshire / Learn · Tech · Databricks · Audit

Coverage & troubleshooting

What Unity Catalog grants and system.* schemas gate which queries — so you can tell in advance what will run — and what to do when a query returns nothing, a band reads NOT ASSESSED, or the dollars look off.

What one grant unlocks

Each query reads one or more system.* schemas. Granting SELECT on a schema (and enabling it for the metastore where it’s in preview) unlocks every query that reads it.

System schemaQueries it unlocksDomains
system.billing37Cost & Billing, Compute, Jobs & Pipelines, Model Serving & AI
system.lakeflow21Jobs & Pipelines
system.query12Query Performance
system.access11Cost & Billing, Governance, Access & Security
system.compute11Compute, Jobs & Pipelines
system.information_schema9Storage & Optimization, Governance, Access & Security
system.storage5Storage & Optimization
system.serving3Model Serving & AI
system.data_classification2Governance, Access & Security
system.ai_gateway1Model Serving & AI
none - DESCRIBE EXTENDED output; not a system table1Storage & Optimization
none - ANALYZE TABLE COMPUTE STORAGE METRICS output; not a system table1Storage & Optimization
none - DESCRIBE EXTENDED / SHOW TBLPROPERTIES output; not a system table1Storage & Optimization

Sums exceed 96 because many queries read more than one system.* schema, so they are counted under each schema they touch. And a schema grant unlocks its queries but not always a whole domain: Cost, for example, includes one query (the workspace-name lookup, cost_workspace_names) that reads system.access, so a system.billing grant alone unlocks 22 of the 23 Cost queries — not the whole domain.

Coverage matrix

Per query: its tier (how heavy), the exact grant it requires, and the system.* tables it reads. Tier is a labelled field heuristic for run order, not a Databricks classification: lite = GA schemas plus a single grant; standard = a commonly-enabled schema, usually a join or window; deep = a heavier scan or a preview / feature-gated table.

Cost & Billing 23

QueryTierRequiresReads
Discount Realization by SKU (actual vs list)cost_actual_vs_list_by_skuDeepSELECT on system.billing; GA
system.billing.usagesystem.billing.list_prices
Per-Job DBU Cost Rankingcost_by_jobStandardSELECT on system.billing; GA
system.billing.usage
Chargeback Coverage by Tagcost_chargeback_by_tagStandardSELECT on system.billing; GA
system.billing.usage
Dollarizing DBUs at List Pricecost_dollarized_by_sku_dayDeepSELECT on system.billing; GA
system.billing.usagesystem.billing.list_prices
Serverless, Photon & Tier Premiumscost_premium_serverless_photonStandardSELECT on system.billing; GA
system.billing.usage
Your List-Price Basis by SKUcost_account_prices_rawLiteSELECT on system.billing; GA
system.billing.list_prices
Where the Money Goes by Productcost_by_billing_origin_productLiteSELECT on system.billing; GA
system.billing.usage
Cost Per Cluster and Warehousecost_by_compute_resourceStandardSELECT on system.billing; GA
system.billing.usage
Ad-hoc notebook DBU costcost_by_notebookStandardSELECT on system.billing; GA
system.billing.usage
Serving & Vector Spend by Endpointcost_by_serving_endpointStandardSELECT on system.billing; GA
system.billing.usage
Chargeback DBUs by Identitycost_chargeback_by_identityStandardSELECT on system.billing; GA
system.billing.usage
Estimated Cloud Spend, DBU-Derivedcost_cloud_infraDeepSELECT on system.billing; GA
system.billing.usagesystem.billing.list_prices
DBSQL Allocation Gap Checkcost_dbsql_allocation_gapDeepSELECT on system.billing; GA
system.billing.usagesystem.billing.attributed_usage
Default-Storage DSU by API Tiercost_default_storage_dsuStandardSELECT on system.billing; GA
system.billing.usage
GenAI Token & GPU Spendcost_genai_token_gpuStandardSELECT on system.billing; GA
system.billing.usage
Billed Data Egress Signalcost_networking_egressStandardSELECT on system.billing; GA
system.billing.usage
Can You Trust the Bill?cost_restatement_trust_metricLiteSELECT on system.billing; GA
system.billing.usage
Model-Serving Cost Mode Per Endpointcost_serving_mode_by_endpointDeepSELECT on system.billing; GA
system.billing.usagesystem.billing.list_prices
The Base Billing Rollupcost_totals_by_sku_dayStandardSELECT on system.billing; GA
system.billing.usage
Serverless Policy Coverage Gapscost_usage_policy_coverageStandardSELECT on system.billing; GA
system.billing.usage
Vector Search Spend by Endpointcost_vector_search_spendDeepSELECT on system.billing; GA
system.billing.usagesystem.billing.list_prices
Workspace ID to Name Lookupcost_workspace_namesLiteSELECT on system.access; GA
system.access.workspaces_latest
The List-Price Rate Bookpricing_list_prices_rawLiteSELECT on system.billing; GA
system.billing.list_prices

Query Performance 12

QueryTierRequiresReads
Your Heaviest Statements, Rankedquery_costly_statementsStandardSELECT on system.query; GA
system.query.history
What This Audit Costs Youaudit_self_costLiteSELECT on system.query; GA
system.query.history
Cache Hits vs. Cold-Start Latencyquery_cache_coldstartStandardSELECT on system.query; GA
system.query.history
Daily Failed & Canceled Queriesquery_failed_queries_dailyStandardSELECT on system.query; GA
system.query.history
Disk Spill Memory-Pressure Hotspotsquery_local_spillageStandardSELECT on system.query; GA
system.query.history
Per-Query Cost Allocation Inputsquery_per_query_estimate_laneDeepSELECT on system.query; GA
system.query.history
Where Query Spend Comes Fromquery_provenance_by_sourceStandardSELECT on system.query; GA
system.query.history
Are Your Scans Skipping Files?query_pruning_effectivenessStandardSELECT on system.query; GA
system.query.history
Capacity Queuing vs Cold-Start Waitsquery_queuing_waitsStandardSELECT on system.query; GA
system.query.history
Shuffle And Small-Files Hotspotsquery_shuffle_write_amplificationStandardSELECT on system.query; GA
system.query.history
When And What Runsquery_workload_mix_hoursStandardSELECT on system.query; GA
system.query.history
Heaviest Query Shapes, Grouped by Fingerprintquery_costly_statements_groupedStandardSELECT on system.query; GA
system.query.history

Compute 10

QueryTierRequiresReads
Warehouse Idle-Tail Secondscompute_warehouse_idle_gapsStandardSELECT on system.compute, system.billing; GA
system.compute.warehouse_eventssystem.billing.usagesystem.billing.list_prices
Live Classic Cluster Config Baselineclassic_clusters_config_currentLiteSELECT on system.compute; GA
system.compute.clusters
Idle Classic Clusters, Rankedcompute_idle_node_ratioStandardSELECT on system.compute, system.billing; GA
system.compute.node_timelinesystem.billing.usagesystem.billing.list_prices
SQL Warehouses Thrashing Clusterscompute_warehouse_autoscale_churnStandardSELECT on system.compute, system.billing; GA
system.compute.warehouse_eventssystem.billing.usagesystem.billing.list_prices
Spot Mix and Instance Idle Signalinstance_events_idle_activeLiteSELECT on system.compute; Public Preview (system.compute.instance_events may be empty or disabled per workspace)
system.compute.instance_events
Idle Instance-Pool Waste Snapshotinstance_pools_idle_capacityStandardSELECT on system.compute, system.billing; Public Preview (system.compute.instance_pools may be empty or disabled per workspace)
system.compute.instance_poolssystem.billing.usagesystem.billing.list_prices
Right-Sizing Evidence From Node Telemetrynode_timeline_utilizationLiteSELECT on system.compute; GA
system.compute.node_timeline
Node Type Hardware Spec Catalognode_types_referenceLiteSELECT on system.compute; GA
system.compute.node_types
Live SQL Warehouse Config Baselinesql_warehouse_config_currentLiteSELECT on system.compute; GA
system.compute.warehouses
SQL Warehouse Event Activitysql_warehouse_events_activityLiteSELECT on system.compute; GA
system.compute.warehouse_events

Jobs & Pipelines 21

QueryTierRequiresReads
Failing Jobs Ranked by Wasted DBUslakeflow_failed_jobs_wasted_dbusDeepSELECT on system.lakeflow, system.billing; GA
system.lakeflow.job_run_timelinesystem.billing.usagesystem.billing.list_prices
Job Tasks On All-Purpose Computelakeflow_jobs_on_all_purposeStandardSELECT on system.lakeflow, system.compute, system.billing; GA
system.lakeflow.job_task_run_timelinesystem.compute.clusterssystem.billing.usagesystem.billing.list_prices
Job Failure Breakdown by Root Causelakeflow_failed_runsLiteSELECT on system.lakeflow; GA
system.lakeflow.job_run_timeline
Job Health-Rule Coveragelakeflow_health_rule_coverageStandardSELECT on system.lakeflow; GA (health_rules was added late Nov 2025)
system.lakeflow.jobs
Orphaned And Handed-Off Jobslakeflow_job_ownership_orphansStandardSELECT on system.lakeflow; GA (creator_user_name/run_as_user_name were added late Nov 2025)
system.lakeflow.jobs
Jobs Stuck Waiting On Capacitylakeflow_job_queue_timeStandardSELECT on system.lakeflow; GA (queue_duration_seconds was added late Nov 2025)
system.lakeflow.job_run_timeline
Task-Level Timeout Coverage Gapslakeflow_job_tasks_no_timeoutStandardSELECT on system.lakeflow, system.billing; GA (job_tasks.timeout_seconds was added late Nov 2025)
system.lakeflow.job_taskssystem.billing.usagesystem.billing.list_prices
Jobs Missing a Timeoutlakeflow_jobs_no_timeoutStandardSELECT on system.lakeflow, system.billing; GA (timeout_seconds was added early Dec 2025)
system.lakeflow.jobssystem.billing.usagesystem.billing.list_prices
Runs Killed Before They Launchedlakeflow_never_started_runsLiteSELECT on system.lakeflow; GA
system.lakeflow.job_run_timeline
Where Job Time Actually Goeslakeflow_phase_cold_startLiteSELECT on system.lakeflow; GA (the five *_duration_seconds columns were added early Dec 2025)
system.lakeflow.job_run_timeline
Per-Pipeline Cost and Over-Refreshlakeflow_pipeline_costDeepSELECT on system.billing, system.lakeflow; GA (system.billing.usage/list_prices); Public Preview (system.lakeflow.pipelines and pipeline_update_timeline - a missing/disabled table degrades names/updates to NULL, never the DBU attribution)
system.billing.usagesystem.billing.list_pricessystem.lakeflow.pipelinessystem.lakeflow.pipeline_update_timeline
Pipeline Active-Time and Idle-Tail Signallakeflow_pipeline_idle_tail_durationStandardSELECT on system.lakeflow, system.billing; Public Preview (system.lakeflow.pipelines and pipeline_update_timeline); GA (system.billing.usage/list_prices)
system.lakeflow.pipeline_update_timelinesystem.lakeflow.pipelinessystem.billing.usagesystem.billing.list_prices
Pipeline Refresh Failures And Retrieslakeflow_pipeline_update_failures_retriesLiteSELECT on system.lakeflow; Public Preview (system.lakeflow.pipeline_update_timeline)
system.lakeflow.pipeline_update_timeline
DLT Pipeline Fleet Inventorylakeflow_pipelines_inventory_tierLiteSELECT on system.lakeflow; Public Preview (system.lakeflow.pipelines)
system.lakeflow.pipelines
Flapping Jobs That Retrylakeflow_retries_repairsStandardSELECT on system.lakeflow, system.billing; GA
system.lakeflow.job_run_timelinesystem.billing.usagesystem.billing.list_prices
Hunting Stale Zombie Jobslakeflow_stale_zombie_jobsStandardSELECT on system.lakeflow, system.billing; GA
system.lakeflow.jobssystem.lakeflow.job_run_timelinesystem.billing.usagesystem.billing.list_prices
Green Runs Hiding Failed Taskslakeflow_succeeded_with_failed_tasksLiteSELECT on system.lakeflow; GA
system.lakeflow.job_run_timelinesystem.lakeflow.job_task_run_timeline
Tasks Running Near Timeoutlakeflow_tasks_near_timeoutStandardSELECT on system.lakeflow; GA (execution_duration_seconds and timeout_seconds were both added late Nov 2025)
system.lakeflow.job_task_run_timelinesystem.lakeflow.job_tasks
Job Failure Root-Cause Breakdownlakeflow_termination_taxonomyLiteSELECT on system.lakeflow; GA
system.lakeflow.job_run_timeline
Discover Job Termination-Type Valueslakeflow_termination_type_probeLiteSELECT on system.lakeflow; GA (the column exists; its value enum is unverified - see caveats)
system.lakeflow.job_run_timeline
Daily Job Run Mix And Hourslakeflow_workload_mix_hoursLiteSELECT on system.lakeflow; GA (execution_duration_seconds was added early Dec 2025)
system.lakeflow.job_run_timeline

Model Serving & AI 4

QueryTierRequiresReads
AI Gateway Abuse Signalscompute_ai_gateway_usageStandardSELECT on system.ai_gateway; must be enabled per-metastore (empty until AI Gateway is enabled on an endpoint)
system.ai_gateway.usage
Idle Serving Endpoints You Pay Forcompute_serving_dormant_endpointsDeepSELECT on system.serving, system.billing; system.serving must be enabled per-metastore (empty until Model Serving is in use); system.billing is GA.
system.serving.served_entitiessystem.serving.endpoint_usagesystem.billing.usagesystem.billing.list_prices
Daily Serving Endpoint Trafficcompute_serving_endpoint_usageDeepSELECT on system.serving, system.billing; system.serving must be enabled per-metastore (empty until Model Serving is in use); system.billing is GA.
system.serving.served_entitiessystem.serving.endpoint_usagesystem.billing.usagesystem.billing.list_prices
Serving Endpoint Traffic Rollupserving_endpoint_traffic_by_endpointDeepSELECT on system.serving, system.billing; system.serving must be enabled per-metastore (empty until Model Serving is in use); system.billing is GA.
system.serving.endpoint_usagesystem.serving.served_entitiessystem.billing.usagesystem.billing.list_prices

Storage & Optimization 9

QueryTierRequiresReads
Detecting UniForm & Managed-Iceberg Tablesiceberg_uniform_metadataDeepDESCRIBE / SELECT privilege on the target table; Unity Catalog required (UniForm / managed-Iceberg detection is a UC feature)
none - DESCRIBE EXTENDED output; not a system table
Liquid Clustering Work and Costpo_clustering_activityStandardSELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional
system.storage.predictive_optimization_operations_history
Clustering Key Churn Detectorpo_clustering_column_churnDeepSELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional
system.storage.predictive_optimization_operations_history
Data-Skipping Stats Backfill Trackerpo_data_skipping_backfillDeepSELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional
system.storage.predictive_optimization_operations_history
Predictive Optimization Cost & Coveragepo_maintenance_cost_by_tableStandardSELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional, 180-day retention
system.storage.predictive_optimization_operations_history
VACUUM Storage Reclaimed Per Tablepo_vacuum_reclaimed_bytesStandardSELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional
system.storage.predictive_optimization_operations_history
Real Table Size Breakdownstorage_breakdown_analyzeDeepprivilege sufficient to run ANALYZE TABLE on the target table; GA but requires DBR 18.0+ (COMPUTE STORAGE METRICS is not available on older runtimes)
none - ANALYZE TABLE COMPUTE STORAGE METRICS output; not a system table
Table Inventory by Type and Formattable_inventory_typeDeepSELECT on system.information_schema; Unity Catalog required
system.information_schema.tables
Delta Time-Travel & Optimize Settingstable_props_time_travel_configStandardDESCRIBE / SELECT privilege on the target table; GA (standard Delta Lake table properties)
none - DESCRIBE EXTENDED / SHOW TBLPROPERTIES output; not a system table

Governance, Access & Security 17

QueryTierRequiresReads
Run-As Privilege Escalation Watchaccess_runas_escalationDeepSELECT on system.access; Public Preview
system.access.audit
Who Changed Permissions, From Whereaccess_admin_role_change_eventsStandardSELECT on system.access; Public Preview
system.access.audit
Sensitive Columns Missing Their Maskaccess_classified_unmaskedStandardSELECT on system.data_classification and system.information_schema; system.data_classification is Public Preview and requires Unity Catalog; column_masks is Public Preview (DBR 12.2 LTS+)
system.data_classification.resultssystem.information_schema.column_masks
Column-Level Lineage Blast Radiusaccess_column_lineage_sensitive_reachDeepSELECT on system.access; GA
system.access.column_lineage
Which Columns Are Actually Maskedaccess_column_masks_inventoryStandardSELECT on system.information_schema; Public Preview, DBR 12.2 LTS+, Unity Catalog required
system.information_schema.column_masks
Where Sensitive Data Actually Livesaccess_data_classification_inventoryStandardSELECT on system.data_classification; Public Preview, Unity Catalog required, needs the data-classification feature AND the system.data_classification schema both enabled
system.data_classification.results
Dead-Table Cleanup Candidatesaccess_dead_table_candidatesStandardSELECT on system.access and system.information_schema; system.access.table_lineage is GA; information_schema requires Unity Catalog
system.access.table_lineagesystem.information_schema.tables
Who Holds Which Grantsaccess_grants_inventoryStandardSELECT on system.information_schema; Unity Catalog required
system.information_schema.table_privilegessystem.information_schema.catalog_privileges
Grants on Schemas and Integrationsaccess_grants_inventory_extendedStandardSELECT on system.information_schema; Unity Catalog required
system.information_schema.schema_privilegessystem.information_schema.connection_privilegessystem.information_schema.credential_privilegessystem.information_schema.external_location_privileges
Login Concentration & Anomaly Rollupaccess_login_concentrationStandardSELECT on system.access; Public Preview
system.access.audit
Blocked Inbound Network Attemptsaccess_network_inbound_denialsDeepSELECT on system.access; Public Preview
system.access.inbound_network
Blocked Egress Exfiltration Attemptsaccess_network_outbound_denialsDeepSELECT on system.access; Public Preview
system.access.outbound_network
PII Leaking Into Untagged Columnsaccess_pii_propagation_untaggedStandardSELECT on system.access and system.information_schema; system.access.column_lineage is GA; information_schema requires Unity Catalog
system.access.column_lineagesystem.information_schema.column_tags
Row Filter Coverage Inventoryaccess_row_filters_inventoryStandardSELECT on system.information_schema; Public Preview, DBR 12.2 LTS+, Unity Catalog required
system.information_schema.row_filters
Table Lineage Blast Radiusaccess_table_lineage_blast_radiusStandardSELECT on system.access; GA
system.access.table_lineage
Manual Governance Tag Inventoryaccess_tags_inventoryStandardSELECT on system.information_schema; Unity Catalog required
system.information_schema.column_tagssystem.information_schema.table_tags
Vector Search Query Traffic by Endpointaccess_vector_search_trafficStandardSELECT on system.access; Public Preview
system.access.audit

Troubleshooting

The query returns no rows

Almost always a schema-enablement gap, not an empty account. Several system.* schemas (e.g. system.query, system.lakeflow, system.serving) are still in preview or must be enabled per-metastore. Check the query’s Requires line and the reads column below: if it names a schema you haven’t enabled, that is the cause. A genuinely quiet account (no failures, no idle clusters) can also legitimately return nothing.

A health band shows NOT ASSESSED

By design. Inventory and reference queries return NOT ASSESSED at runtime because they carry no pass/fail band — they return state to read (a configuration, a price basis, a role list), so there is no OK/WARN/CRITICAL to compute. It is a runtime outcome, not a column in the matrix above. The money-trust queries also leave the dollar figure “not assessed” when Databricks exposes no per-row DBU column: that is an honest gap, not an omission — the magnitude (count, runtime, quantity) is still reported.

TABLE_OR_VIEW_NOT_FOUND / a schema is missing

The schema isn’t enabled for your metastore, or your principal lacks SELECT on it. Every query’s Requires line states the grant it needs (e.g. SELECT on system.billing; GA). Grant SELECT on the parent system schema (or ask your account admin to enable it) — the coverage matrix below shows how many queries a single grant unlocks.

A priced-coverage gap: my dollars look off

When system.billing.account_prices is absent (it is not present in every environment), the queries fall back to list price and label the figure est · at list — pre-discount, DBU-only, and directional, never your negotiated invoice. An untagged or unpriced slice means one GROUP BY group had no matching price row, not that the whole account is unpriced. See the reference glossary for the list-vs-account and est · at list definitions.

New here? Start with the first-audit runbook, follow an investigation trail, and keep the reference & glossary open.