- Shared semantics
- Active Queries
- Budgets
- Data Schemas
- Data Volume
- Dynamic Tables
- Event Log
- Event Usage
- Login History
- Query History
- Resource Monitors
- Shares
- Tasks
- Trust Center
- Users
- Warehouse Usage
| Identifier | Description | Example |
|---|---|---|
| db.system | The database management system (DBMS) product being used. It is always 'snowflake' | snowflake |
| deployment.environment | The deployment environment, e.g., production, staging, or development. | PROD |
| deployment.environment.tag | Optional tag for the deployment environment in multitenancy mode | SA080 |
| dsoa.run.context | The name of the Dynatrace Snowflake Observability Agent plugin (or part of plugin) used to produce the telemetry (logs, traces, metrics, or events). | query_history |
| host.name | The name of the host. | mysnowflake.us-east-1.snowflakecomputing.com |
| service.name | The name of the service. | mysnowflake.us-east-1 |
| telemetry.exporter.name | The name of the telemetry exporter. It is always 'dynatrace.snowagent' | dynatrace.snowagent |
| telemetry.exporter.version | The version of the telemetry exporter. | 0.8.0.17308403933 |
| Identifier | Description | Example |
|---|---|---|
| dsoa.run.id | Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, e.g., to calculate the change in the system. | 4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d |
| snowflake.event.type | Type of (timestamp based) event | snowflake.table.update |
All telemetry delivered by this plugin is reported as dsoa.run.context == "active_queries".
| Identifier | Description | Example |
|---|---|---|
| db.namespace | The name of the database in which the query was executed. | analytics_db |
| db.user | The name of the user who executed the query. | john_doe |
| snowflake.query.execution_status | The execution status of the query, such as: - RESUMING_WAREHOUSE, - RUNNING, - QUEUED, - BLOCKED, - SUCCESS, - FAILED_WITH_ERROR, - FAILED_WITH_INCIDENT. |
FAILED_WITH_ERROR |
| snowflake.role.name | The role that was active in the session at the time of the query. | analyst_role |
| snowflake.warehouse.name | The name of the warehouse used to execute the query. | compute_wh |
| Identifier | Description | Example |
|---|---|---|
| db.operation.name | The type of operation performed by the query, such as: - SELECT, - INSERT, - UPDATE. |
SELECT |
| db.query.text | The text of the SQL query. | SELECT * FROM sales_data |
| session.id | The unique identifier for the session in which the query was executed. | 123456789 |
| snowflake.error.code | The error code if the query failed. | 1001 |
| snowflake.error.message | The error message if the query failed. | Syntax error in SQL statement |
| snowflake.query.hash | The hash value of the query text. | hash_abcdef |
| snowflake.query.hash_version | The version of the query hash logic. | 1 |
| snowflake.query.id | The unique identifier for the query. | b1bbaa7f-8144-4e50-947a-b7e9bf7d62d5 |
| snowflake.query.parametrized_hash | The hash value of the parameterized query text. | param_hash_abcdef |
| snowflake.query.parametrized_hash_version | The version of the parameterized query hash logic. | 1 |
| snowflake.query.tag | The tag associated with the query, if any. | daily_report |
| snowflake.schema.name | The name of the schema in which the query was executed. | public |
| snowflake.warehouse.type | The type of warehouse used to execute the query. | STANDARD |
| Identifier | Name | Unit | Description | Example |
|---|---|---|---|---|
| snowflake.data.written_to_result | Bytes Written to Result | bytes | Number of bytes written to a result object. | 1048576 |
| snowflake.rows.written_to_result | Rows Written to Result | rows | Number of rows written to a result object. For CREATE TABLE AS SELECT (CTAS) and all DML operations, this result is 1;. | 1 |
| snowflake.time.compilation | Query Compilation Time | ms | The total compilation time of the currently running query. | 5000 |
| snowflake.time.execution | Execution Time | ms | Execution time (in milliseconds) | 100000 |
| snowflake.time.running | Query Running Time | ms | The total running time of the currently running query. | 120000 |
| snowflake.time.total_elapsed | Total Elapsed Time | ms | Elapsed time (in milliseconds). | 120000 |
All telemetry delivered by this plugin is reported as dsoa.run.context == "budgets".
| Identifier | Description | Example |
|---|---|---|
| db.namespace | The name of the database that was specified in the context of the query at compilation. | analytics_db |
| snowflake.budget.name | Name of the budget. | monthly_budget |
| snowflake.schema.name | Schema that was specified in the context of the query at compilation. | public |
| snowflake.service.type | Type of service that is consuming credits, which can be one of the following: - AUTO_CLUSTERING, - HYBRID_TABLE_REQUESTS, - MATERIALIZED_VIEW, - PIPE, - QUERY_ACCELERATION, - SEARCH_OPTIMIZATION, - SERVERLESS_ALERTS, - SERVERLESS_TASK, - SNOWPIPE_STREAMING, - WAREHOUSE_METERING, - WAREHOUSE_METERING_READER |
WAREHOUSE_METERING |
| Identifier | Description | Example |
|---|---|---|
| snowflake.budget.owner | The owner of the budget, typically the user or role responsible for managing the budget. | budget_admin |
| snowflake.budget.owner.role_type | The type of role assigned to the budget owner, indicating their level of access and responsibilities. | ACCOUNTADMIN |
| snowflake.budget.resource | The resources linked to the budget, such as databases, warehouses, or other Snowflake objects that the budget monitors. | [ "database1", "warehouse1" ] |
| Identifier | Name | Unit | Description | Example |
|---|---|---|---|---|
| snowflake.credits.limit | Budget Spending Limit | credits | The number of credits set as the spending limit for the budget. | 100 |
| snowflake.credits.spent | Credits Spent | credits | Number of credits used. | 75 |
| Identifier | Description | Example |
|---|---|---|
| snowflake.budget.created_on | The timestamp when the budget was created. | 2024-11-30 23:59:59.999 |
| snowflake.event.trigger | Additionally to sending logs, each entry in EVENT_TIMESTAMPS is sent as event with key set to snowflake.event.trigger, value to key from EVENT_TIMESTAMPS and timestamp set to the key value. |
snowflake.budget.created_on |
All telemetry delivered by this plugin is reported as dsoa.run.context == "data_schemas".
| Identifier | Description | Example |
|---|---|---|
| db.user | The user who issued the query. | SYSTEM |
| snowflake.object.ddl.modified | A JSON array that specifies the objects that were associated with a write operation in the query. | { "DTAGENT_DB.APP.TMP_RECENT_QUERIES": { "objectColumns": "HISTOGRAM_METRICS, COUNTER_METRICS, START_TIME, STATUS_CODE, SESSION_ID, QUERY_ID, DIMENSIONS, END_TIME, NAME, ATTRIBUTES, PARENT_QUERY_ID", "objectDomain": "Table" } } |
| snowflake.object.ddl.operation | The SQL keyword that specifies the operation on the table, view, or column: - ALTER, - CREATE, - DROP, - REPLACE, - UNDROP. |
REPLACE |
| snowflake.object.ddl.properties | A JSON array that specifies the object or column properties when you create, modify, drop, or undrop the object or column. There are two types of properties: atomic and compound. | {"creationMode": "CREATE", "columns": {"ADD": ["ATTRIBUTE","JOB_ID"]}} |
| snowflake.object.id | An identifier for the object, which is unique within a given account and domain. | 747545 |
| snowflake.object.name | The fully qualified name of the object defined or modified by the DDL operation. | DTAGENT_DB.APP.TMP_RECENT_QUERIES |
| snowflake.object.type | The domain of the object defined or modified by the DDL operation, which includes all objects that can be tagged and: - MASKING POLICY, - ROW ACCESS POLICY, - TAG. |
Table |
| snowflake.query.id | An internal, system -generated identifier for the SQL statement. |
01b30d58-0604-6e1c-0040-e003029c1322 |
| snowflake.query.parent_id | The query ID of the parent job or NULL if the job does not have a parent. | 01b2fd01-0604-6864-0040-e003029abda2 |
| snowflake.query.root_id | The query ID of the top most job in the chain or NULL if the job does not have a parent. | 01b2fd00-0604-6864-0040-e003029abd82 |
All telemetry delivered by this plugin is reported as dsoa.run.context == "data_volume".
| Identifier | Description | Example |
|---|---|---|
| db.collection.name | The full name of the table, including the catalog, schema, and table name. | analytics_db.public.sales_data |
| db.namespace | The name of the database that contains the table. | analytics_db |
| snowflake.table.type | The type of the table, such as: - BASE TABLE, - TEMPORARY TABLE, - EXTERNAL TABLE. |
BASE TABLE |
| Identifier | Name | Unit | Description | Example |
|---|---|---|---|---|
| snowflake.data.rows | Row Count | rows | Sum of all rows in all objects in this scope. | 1000000 |
| snowflake.data.size | Table Size in Bytes | bytes | Total size (in bytes) of all objects in this scope. | 1073741824 |
| snowflake.table.time_since.last_ddl | Time Since Last DDL | min | Time (in minutes) since last time given objects structure was altered. | 2880 |
| snowflake.table.time_since.last_update | Time Since Last Update | min | Time (in minutes) since last time content of given objects was updated. | 1440 |
| Identifier | Description | Example |
|---|---|---|
| snowflake.event.trigger | Additionally to sending logs, each entry in EVENT_TIMESTAMPS is sent as event with key set to snowflake.event.trigger, value to key from EVENT_TIMESTAMPS and timestamp set to the key value. |
snowflake.table.update |
| snowflake.table.ddl | Timestamp of the last DDL operation performed on the table or view. All supported table/view DDL operations update this field: - CREATE, - ALTER, - DROP, - UNDROP |
2024-11-01 12:00:00.000 |
| snowflake.table.update | Date and time the object was last altered by a DML, DDL, or background metadata operation. | 2024-11-10 16:45:00.000 |
This plugin delivers telemetry in multiple contexts. To filter by one of plugin's context names (reported as dsoa.run.context), please check the Context Name column below.
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| db.collection.name | Name of the dynamic table. | EMPLOYEE_DET | dynamic_tables, dynamic_table_refresh_history, dynamic_table_graph_history |
| db.namespace | The name of the database in which the query was executed. | DYNAMIC_TABLE_DB | dynamic_tables, dynamic_table_refresh_history, dynamic_table_graph_history |
| snowflake.schema.name | Name of the schema that contains the dynamic table. | DYNAMIC_TABLE_SCH | dynamic_tables, dynamic_table_refresh_history, dynamic_table_graph_history |
| snowflake.table.full_name | Fully qualified name of the dynamic table. | DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE_DET | dynamic_tables, dynamic_table_refresh_history, dynamic_table_graph_history |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| db.query.text | The SELECT statement for this dynamic table. | SELECT A.EMP_ID,A.EMP_NAME,A.EMP_ADDRESS, B.SKILL_ID,B.SKILL_NAME,B.SKILL_LEVEL FROM EMPLOYEE A, EMPLOYEE_SKILL B WHERE A.EMP_ID=B.EMP_ID ORDER BY B.SKILL_ID ; | dynamic_table_graph_history |
| snowflake.query.id | If present, this represents the query ID of the refresh job that produced the results for the dynamic table. | 01b899f1-0712-45a6-0040-e00303977b8e | dynamic_tables, dynamic_table_refresh_history |
| snowflake.table.dynamic.graph.alter_trigger | Describes why a new entry is created in the DYNAMIC_TABLE_GRAPH_HISTORY function. Can be one of the following: - NONE (backwards -compatible), - CREATE_DYNAMIC_TABLE, - ALTER_TARGET_LAG, - SUSPEND, RESUME, - REPLICATION_REFRESH, - ALTER_WAREHOUSE. |
[ "CREATE_DYNAMIC_TABLE" ] | dynamic_table_graph_history |
| snowflake.table.dynamic.graph.inputs | Each OBJECT represents a table, view, or dynamic table that serves as the input to this dynamic table. | [ { "kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE" }, { "kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE_SKILL" } ] | dynamic_table_graph_history |
| snowflake.table.dynamic.graph.valid_from | Encodes the VALID_FROM timestamp of the DYNAMIC_TABLE_GRAPH_HISTORY table function when the refresh occurred. | 2024-11-20 19:53:47.448 Z | dynamic_table_refresh_history, dynamic_table_graph_history |
| snowflake.table.dynamic.graph.valid_to | If present, the description of the dynamic table is valid up to this time. If null, the description is still accurate. | dynamic_table_graph_history | |
| snowflake.table.dynamic.lag.target.type | The type of target lag. | USER_DEFINED | dynamic_tables, dynamic_table_graph_history |
| snowflake.table.dynamic.latest.code | Code representing the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error code associated with the failure. | SUCCESS | dynamic_tables |
| snowflake.table.dynamic.latest.data_timestamp | Data timestamp of the last successful refresh. | 2024-11-22 12:55:29.695 Z | dynamic_tables |
| snowflake.table.dynamic.latest.dependency.data_timestamp | Data timestamp of the latest dependency to become available. | 2024-11-25 06:09:53.695 Z | dynamic_table_refresh_history |
| snowflake.table.dynamic.latest.dependency.name | Qualified name of the latest dependency to become available. | DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE | dynamic_table_refresh_history |
| snowflake.table.dynamic.latest.message | Description of the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error message associated with the failure. | dynamic_tables | |
| snowflake.table.dynamic.latest.state | Status of the last terminated refresh for the dynamic table. Can be one of the following: - SUCCEEDED: Refresh completed successfully, - FAILED: Refresh failed during execution, - UPSTREAM_FAILED: Refresh not performed due to an upstream failed refresh, - CANCELLED: Refresh was canceled before execution. |
SUCCEEDED | dynamic_tables |
| snowflake.table.dynamic.refresh.action | Describes the type of refresh action performed. One of: - NO_DATA: no new data in base tables. Doesn’t apply to the initial refresh of newly created dynamic tables whether or not the base tables have data, - REINITIALIZE: base table changed or source table of a cloned dynamic table was refreshed during clone, - FULL: Full refresh, because dynamic table contains query elements that are not incremental (see SHOW DYNAMIC TABLE refresh_mode_reason) or because full refresh was cheaper than incremental refresh, - INCREMENTAL: normal incremental refresh. |
NO_DATA | dynamic_table_refresh_history |
| snowflake.table.dynamic.refresh.code | Code representing the current state of the refresh. | SUCCESS | dynamic_table_refresh_history |
| snowflake.table.dynamic.refresh.completion_target | Time by which this refresh should complete to keep lag under the TARGET_LAG parameter for the dynamic table. | 2024-11-25 06:10:05.695 Z | dynamic_table_refresh_history |
| snowflake.table.dynamic.refresh.data_timestamp | Transactional timestamp when the refresh was evaluated. | 2024-11-25 06:09:53.695 Z | dynamic_table_refresh_history |
| snowflake.table.dynamic.refresh.end | Time when the refresh completed. | 2024-11-25 06:09:55.308 Z | dynamic_table_refresh_history |
| snowflake.table.dynamic.refresh.message | Description of the current state of the refresh. | dynamic_table_refresh_history | |
| snowflake.table.dynamic.refresh.start | Time when the refresh job started. | 2024-11-25 06:09:54.978 Z | dynamic_table_refresh_history |
| snowflake.table.dynamic.refresh.state | Status of the refresh for the dynamic table. The status can be one of the following: - SCHEDULED: refresh scheduled, but not yet executed, - EXECUTING: refresh in progress, - SUCCEEDED: refresh completed successfully, - FAILED: refresh failed during execution, - CANCELLED: refresh was canceled before execution, - UPSTREAM_FAILED: refresh not performed due to an upstream failed refresh. |
SUCCEEDED | dynamic_table_refresh_history |
| snowflake.table.dynamic.refresh.trigger | Describes the trigger for the refresh. One of: - SCHEDULED: normal background refresh to meet target lag or downstream target lag, - MANUAL: user/task used ALTER DYNAMIC TABLE REFRESH, - CREATION: refresh performed during the creation DDL statement, triggered by the creation of the dynamic table or any consumer dynamic tables. |
SCHEDULED | dynamic_table_refresh_history |
| snowflake.table.dynamic.scheduling.reason.code | Optional reason code if the state is not ACTIVE. | MAINTENANCE | dynamic_tables, dynamic_table_graph_history |
| snowflake.table.dynamic.scheduling.reason.message | Text description of the reason the dynamic table is not active. Only applies if the state is not active. | Scheduled maintenance | dynamic_tables, dynamic_table_graph_history |
| snowflake.table.dynamic.scheduling.state | Scheduling state of the dynamic table. | ACTIVE | dynamic_tables, dynamic_table_graph_history |
| Identifier | Name | Unit | Description | Example | Context Name |
|---|---|---|---|---|---|
| snowflake.partitions.added | Partitions Added | partitions | The number of partitions added during the refresh. | 5 | dynamic_table_refresh_history |
| snowflake.partitions.removed | Partitions Removed | partitions | The number of partitions removed during the refresh. | 3 | dynamic_table_refresh_history |
| snowflake.rows.copied | Rows Copied | rows | The number of rows copied during the refresh. | 75 | dynamic_table_refresh_history |
| snowflake.rows.deleted | Rows Deleted | rows | The number of rows deleted during the refresh. | 50 | dynamic_table_refresh_history |
| snowflake.rows.inserted | Rows Inserted | rows | The number of rows inserted during the refresh. | 100 | dynamic_table_refresh_history |
| snowflake.table.dynamic.lag.max | Maximum Lag Time | seconds | The maximum lag time in seconds of refreshes for this dynamic table. | 83 | dynamic_tables |
| snowflake.table.dynamic.lag.mean | Mean Lag Time | seconds | The mean lag time (in seconds) of refreshes for this dynamic table. | 26 | dynamic_tables |
| snowflake.table.dynamic.lag.target.time_above | Time Above Target Lag | seconds | The time in seconds when the actual lag was more than the defined target lag. | 151 | dynamic_tables |
| snowflake.table.dynamic.lag.target.value | Target Lag Time | seconds | The time in seconds in the retention period or since the last configuration change, when the actual lag was more than the defined target lag. | 60 | dynamic_table_refresh_history, dynamic_table_graph_history |
| snowflake.table.dynamic.lag.target.within_ratio | Time Within Target Lag Ratio | ratio | The ratio of time in the retention period or since the last configuration change, when actual lag is within the target lag. | 0.999 | dynamic_tables |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| snowflake.event.trigger | Additionally to sending logs, each entry in EVENT_TIMESTAMPS is sent as event with key set to snowflake.event.trigger, value to key from EVENT_TIMESTAMPS and timestamp set to the key value. |
snowflake.table.dynamic.scheduling.resumed_on | dynamic_table_refresh_history, dynamic_table_graph_history |
| snowflake.table.dynamic.graph.valid_from | The description of the dynamic table is valid after this time. | 2024-11-20 19:53:47.448 Z | dynamic_table_refresh_history, dynamic_table_graph_history |
| snowflake.table.dynamic.scheduling.resumed_on | Optional timestamp when it was last resumed if dynamic table is ACTIVE. | 2024-11-25 08:09:53.695 Z | dynamic_table_graph_history |
| snowflake.table.dynamic.scheduling.suspended_on | Optional timestamp when the dynamic table was suspended. | 2024-11-25 06:09:53.695 Z | dynamic_table_graph_history |
This plugin delivers telemetry in multiple contexts. To filter by one of plugin's context names (reported as dsoa.run.context), please check the Context Name column below.
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| db.namespace | The name of the database that was specified in the context of the query at compilation. | PROD_DB | event_log_metrics, event_log_spans |
| snowflake.query.id | The unique identifier for the query. | b1bbaa7f-8144-4e50-947a-b7e9bf7d62d5 | event_log_metrics, event_log_spans |
| snowflake.role.name | The role used to execute the query. | SYSADMIN | event_log_metrics, event_log_spans |
| snowflake.schema.name | The name of the schema in which the query was executed. | public | event_log_metrics, event_log_spans |
| snowflake.warehouse.name | The warehouse used to execute the query. | COMPUTE_WH | event_log_metrics, event_log_spans |
| Identifier | Name | Unit | Description | Example | Context Name |
|---|---|---|---|---|---|
| process.cpu.utilization | Process CPU Utilization | 1 | The percentage of CPU utilization by the process. | 0.015 | event_log_metrics |
| process.memory.usage | Process Memory Usage | bytes | The total memory usage by the process in bytes. | 34844672 | event_log_metrics |
All telemetry delivered by this plugin is reported as dsoa.run.context == "event_usage".
| Identifier | Name | Unit | Description | Example |
|---|---|---|---|---|
| snowflake.credits.used | Snowflake Credits Used | credits | Number of credits billed for loading data into the event table during the START_TIME and END_TIME window. | 15 |
| snowflake.data.ingested | Bytes Ingested for Event Table | bytes | Number of bytes of data loaded during the START_TIME and END_TIME window. | 10485760 |
This plugin delivers telemetry in multiple contexts. To filter by one of plugin's context names (reported as dsoa.run.context), please check the Context Name column below.
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| client.ip | The IP address of the client that initiated the event. | 192.168.1.1 | login_history |
| client.type | The type of client used to connect to Snowflake, such as JDBC_DRIVER or ODBC_DRIVER. | JDBC_DRIVER | login_history |
| db.user | The user who performed the event in the database. | john_doe | login_history, sessions |
| event.name | The type of event that occurred, such as: - LOGIN, - LOGOUT. |
LOGIN | login_history |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| authentication.factor.first | The first factor used for authentication, typically a password. | password123 | login_history |
| authentication.factor.second | The second factor used for authentication, such as an MFA token, or NULL if not applicable. | MFA_TOKEN_ABC123 | login_history |
| authentication.type | The type of authentication used for the session. | PASSWORD | sessions |
| client.application.id | The ID of the client application used for the session. | app123 | sessions |
| client.application.version | The version of the client application used for the session. | 1.0.0 | sessions |
| client.build_id | The build ID of the client application. | build123 | sessions |
| client.environment | The environment of the client application. | PRODUCTION | sessions |
| client.version | The version of the client software used to connect to Snowflake. | 1.0.0 | login_history, sessions |
| db.snowflake.connection | The name of the connection used by the client, or NULL if the client is not using a connection URL. | connection_1 | login_history |
| error.code | The error code associated with the login attempt, if it was not successful. | ERR001 | login_history |
| event.id | A unique identifier for the login attempt or the login event associated with the session. | 123456789 | login_history, sessions |
| event.related_id | An identifier for a related event, if applicable. | 987654321 | login_history |
| session.id | The unique identifier for the session. | session123 | sessions |
| snowflake.session.closed_reason | The reason the session was closed. | USER_LOGOUT | sessions |
| snowflake.session.start | The start time of the session. | 1633046400000000000 | sessions |
| status.code | The status of the login attempt, indicating success (OK) or failure (ERROR). | OK | login_history |
| status.message | A message providing additional details about the status of the login attempt. | Login successful | login_history |
All telemetry delivered by this plugin is reported as dsoa.run.context == "query_history".
| Identifier | Description | Example |
|---|---|---|
| db.collection.name | The name of the table involved in the query. | users |
| db.namespace | The name of the database that was specified in the context of the query at compilation. | PROD_DB |
| db.operation.name | The type of operation performed by the query. | SELECT |
| db.snowflake.dbs | The databases involved in the query. | PROD_DB |
| db.user | Snowflake user who issued the query. | admin |
| snowflake.query.execution_status | The execution status of the query. | SUCCESS |
| snowflake.role.name | The role used to execute the query. | SYSADMIN |
| snowflake.warehouse.name | The warehouse used to execute the query. | COMPUTE_WH |
| Identifier | Description | Example |
|---|---|---|
| authentication.type | The authentication method used for the session. | PASSWORD |
| client.application.id | The ID of the client application used to execute the query. | app123 |
| client.application.version | The version of the client application used to execute the query. | 1.0.0 |
| client.build_id | The build ID of the client application. | build123 |
| client.environment | The environment of the client application. | production |
| client.version | The version of the client. | 1.0.0 |
| db.query.text | The text of the query. | SELECT * FROM users; |
| db.snowflake.tables | The tables involved in the query. | users |
| db.snowflake.views | The views involved in the query. | user_view |
| dsoa.debug.span.events.added | Internal debug field indicating the number of span events successfully added to the given span. | 5 |
| dsoa.debug.span.events.failed | Internal debug field indicating the number of span events that failed to be added to the given span. | 1 |
| event.id | The login event ID associated with the query. | login123 |
| session.id | The session ID during which the query was executed. | 1234567890 |
| snowflake.cluster_number | The cluster number associated with the query. | cluster1 |
| snowflake.database.id | The unique identifier of the database involved in the query. | db123 |
| snowflake.error.code | The error code returned by the query, if any. | ERR123 |
| snowflake.error.message | The error message returned by the query, if any. | Syntax error |
| snowflake.query.accel_est.estimated_query_times | Object that contains the estimated query execution time in seconds for different query acceleration scale factors. If the status for the query is not eligible for query acceleration, this object is empty. | { "scaleFactor1": 10, "scaleFactor2": 5 } |
| snowflake.query.accel_est.status | Indicates whether the query is eligible to benefit from the query acceleration service. Possible values are: eligible, ineligible, accelerated, invalid. | eligible |
| snowflake.query.accel_est.upper_limit_scale_factor | Number of the highest query acceleration scale factor in the estimatedQueryTimes object. If the status for the query is not eligible for query acceleration, this field is set to 0. | 2 |
| snowflake.query.data_transfer.inbound.cloud | The cloud provider from which data was transferred inbound. | AWS |
| snowflake.query.data_transfer.inbound.region | The region from which data was transferred inbound. | us-west-2 |
| snowflake.query.data_transfer.outbound.cloud | The cloud provider to which data was transferred outbound. | AWS |
| snowflake.query.data_transfer.outbound.region | The region to which data was transferred outbound. | us-west-2 |
| snowflake.query.hash | The hash of the query text. | hash123 |
| snowflake.query.hash_version | The version of the query hash. | v1 |
| snowflake.query.id | The unique identifier for the query. | b1bbaa7f-8144-4e50-947a-b7e9bf7d62d5 |
| snowflake.query.is_client_generated | Indicates if the statement was generated by the client. | true |
| snowflake.query.operator.attributes | Information about the operator, depending on the operator type. | { "equality_join_condition": "(T4.C = T1.C)", "join_type": "INNER" } |
| snowflake.query.operator.id | The operator’s identifier, unique within the query. Values start at 0. | 0 |
| snowflake.query.operator.parent_ids | Identifiers of the parent operators for this operator, or NULL if this is the final operator in the query plan. | [0] |
| snowflake.query.operator.stats | Statistics about the operator (e.g., the number of output rows from the operator). | { "input_rows": 64, "output_rows": 64 } |
| snowflake.query.operator.time | The breakdown of the execution time of the operator: - overall_percentage: The percentage of the total query time spent by this operator, - initialization: Time spent setting up query processing, - processing: Time spent processing the data by the CPU, - synchronization: Time spent synchronizing activities between participating processes, - local_disk_io: Time during which processing was blocked while waiting for local disk access, - remote_disk_io: Time during which processing was blocked while waiting for remote disk access, - network_communication: Time during which processing was waiting for network data transfer. |
{ "overall_percentage": 50.0,"initialization": 0.5,"processing": 4.0,"synchronization": 0.5,"local_disk_io": 0.2,"remote_disk_io": 0.1,"network_communication": 0.2 } |
| snowflake.query.operator.type | The type of query operator (e.g., TableScan or Filter). | TableScan |
| snowflake.query.parametrized_hash | The hash of the parameterized query text. | param_hash123 |
| snowflake.query.parametrized_hash_version | The version of the parameterized query hash. | v1 |
| snowflake.query.parent_id | The unique identifier for the parent query, if applicable. | parent123 |
| snowflake.query.retry_cause | The cause for retrying the query, if applicable. | Network issue |
| snowflake.query.step.id | Identifier of the step in the query plan. | 1 |
| snowflake.query.tag | The tag associated with the query. | tag1 |
| snowflake.query.transaction_id | The transaction ID associated with the query. | txn123 |
| snowflake.query.with_operator_stats | Indicates if the query was executed with operator -level statistics enabled. |
True |
| snowflake.release_version | The release version of Snowflake at the time of query execution. | 5.0 |
| snowflake.role.type | The type of role used to execute the query. | PRIMARY |
| snowflake.schema.id | The unique identifier of the schema involved in the query. | schema123 |
| snowflake.schema.name | The name of the schema involved in the query. | public |
| snowflake.secondary_role_stats | Statistics related to secondary roles used during the query execution. | role_stat1 |
| snowflake.session.closed_reason | The reason the session was closed. | User logout |
| snowflake.session.start | The start time of the session. | 2024-11-05T21:11:07Z |
| snowflake.warehouse.cluster.number | The cluster number of the warehouse used. | cluster1 |
| snowflake.warehouse.id | The unique identifier of the warehouse used. | wh123 |
| snowflake.warehouse.size | The size of the warehouse used. | X-SMALL |
| snowflake.warehouse.type | The type of warehouse used. | STANDARD |
| Identifier | Name | Unit | Description | Example |
|---|---|---|---|---|
| snowflake.acceleration.data.scanned | Query Acceleration Bytes Scanned | bytes | Number of bytes scanned by the query acceleration service. | 2097152 |
| snowflake.acceleration.partitions.scanned | Query Acceleration Partitions Scanned | partitions | Number of partitions scanned by the query acceleration service. | 50 |
| snowflake.acceleration.scale_factor.max | Query Acceleration Upper Limit Scale Factor | factor | Upper limit scale factor that a query would have benefited from. | 4 |
| snowflake.credits.cloud_services | Cloud Services Credits Used | credits | Number of credits used for cloud services. | 10 |
| snowflake.data.deleted | Bytes Deleted | bytes | Number of bytes deleted by the query. | 1048576 |
| snowflake.data.read.from_result | Bytes Read from Result | bytes | Number of bytes read from a result object. | 1048576 |
| snowflake.data.scanned | Bytes Scanned | bytes | Number of bytes scanned by this statement. | 10485760 |
| snowflake.data.scanned_from_cache | Percentage Scanned from Cache | percent | The percentage of data scanned from the local disk cache. The value ranges from 0.0 to 1.0. Multiply by 100 to get a true percentage. | 75 |
| snowflake.data.sent_over_the_network | Bytes Sent Over the Network | bytes | Volume of data sent over the network. | 524288 |
| snowflake.data.spilled.local | Bytes Spilled to Local Storage | bytes | Volume of data spilled to local disk. | 1048576 |
| snowflake.data.spilled.remote | Bytes Spilled to Remote Storage | bytes | Volume of data spilled to remote disk. | 2097152 |
| snowflake.data.transferred.inbound | Inbound Data Transfer Bytes | bytes | Number of bytes transferred in statements that load data from another region and/or cloud. | 10485760 |
| snowflake.data.transferred.outbound | Outbound Data Transfer Bytes | bytes | Number of bytes transferred in statements that unload data to another region and/or cloud. | 5242880 |
| snowflake.data.written | Bytes Written | bytes | Number of bytes written (e.g. when loading into a table). | 2097152 |
| snowflake.data.written_to_result | Bytes Written to Result | bytes | Number of bytes written to a result object. | 1048576 |
| snowflake.external_functions.data.received | External Function Total Received Bytes | bytes | The total number of bytes that this query received from all calls to all remote services. | 1048576 |
| snowflake.external_functions.data.sent | External Function Total Sent Bytes | bytes | The total number of bytes that this query sent in all calls to all remote services. | 524288 |
| snowflake.external_functions.invocations | External Function Total Invocations | count | The aggregate number of times that this query called remote services. For important details, see the Usage Notes. | 5 |
| snowflake.external_functions.rows.received | External Function Total Received Rows | rows | The total number of rows that this query received from all calls to all remote services. | 1000 |
| snowflake.external_functions.rows.sent | External Function Total Sent Rows | rows | The total number of rows that this query sent in all calls to all remote services. | 500 |
| snowflake.load.used | Query Load Percent | percent | The approximate percentage of active compute resources in the warehouse for this query execution. | 85 |
| snowflake.partitions.scanned | Partitions Scanned | partitions | Number of micro -partitions scanned. |
100 |
| snowflake.partitions.total | Partitions Total | partitions | Total micro -partitions of all tables included in this query. |
500 |
| snowflake.rows.deleted | Rows Deleted | rows | Number of rows deleted by the query. | 500 |
| snowflake.rows.inserted | Rows Inserted | rows | Number of rows inserted by the query. | 1000 |
| snowflake.rows.unloaded | Rows Unloaded | rows | Number of rows unloaded during data export. | 1000 |
| snowflake.rows.updated | Rows Updated | rows | Number of rows updated by the query. | 300 |
| snowflake.rows.written_to_result | Rows Written to Result | rows | Number of rows written to a result object. For CREATE TABLE AS SELECT (CTAS) and all DML operations, this result is 1;. | 1 |
| snowflake.time.child_queries_wait | Child Queries Wait Time | ms | Time (in milliseconds) to complete the cached lookup when calling a memoizable function. | 200 |
| snowflake.time.compilation | Query Compilation Time | ms | Compilation time (in milliseconds) | 5000 |
| snowflake.time.execution | Execution Time | ms | Execution time (in milliseconds) | 100000 |
| snowflake.time.fault_handling | Fault Handling Time | ms | Total execution time (in milliseconds) for query retries caused by errors that are not actionable. | 1500 |
| snowflake.time.list_external_files | List External Files Time | ms | Time (in milliseconds) spent listing external files. | 300 |
| snowflake.time.queued.overload | Queued Overload Time | ms | Time (in milliseconds) spent in the warehouse queue, due to the warehouse being overloaded by the current query workload. | 1500 |
| snowflake.time.queued.provisioning | Queued Provisioning Time | ms | Time (in milliseconds) spent in the warehouse queue, waiting for the warehouse compute resources to provision, due to warehouse creation, resume, or resize. | 3000 |
| snowflake.time.repair | Queued Repair Time | ms | Time (in milliseconds) spent in the warehouse queue, waiting for compute resources in the warehouse to be repaired. | 500 |
| snowflake.time.retry | Query Retry Time | ms | Total execution time (in milliseconds) for query retries caused by actionable errors. | 2000 |
| snowflake.time.total_elapsed | Total Elapsed Time | ms | Elapsed time (in milliseconds). | 120000 |
| snowflake.time.transaction_blocked | Transaction Blocked Time | ms | Time (in milliseconds) spent blocked by a concurrent DML. | 1000 |
All telemetry delivered by this plugin is reported as dsoa.run.context == "resource_monitors".
| Identifier | Description | Example |
|---|---|---|
| snowflake.resource_monitor.name | The name of the resource monitor. | RM_MONITOR |
| snowflake.warehouse.name | The name of the warehouse. | COMPUTE_WH |
| Identifier | Description | Example |
|---|---|---|
| snowflake.budget.name | The name of the budget associated with the warehouse. | BUDGET_2024 |
| snowflake.credits.quota | The credit quota of the resource monitor. | 1000 |
| snowflake.credits.quota.remaining | The remaining credits of the resource monitor. | 500 |
| snowflake.credits.quota.used | The credits used by the resource monitor. | 500 |
| snowflake.resource_monitor.frequency | The frequency of the resource monitor. | DAILY |
| snowflake.resource_monitor.is_active | Indicates if the resource monitor is active. | true |
| snowflake.resource_monitor.level | The level of the resource monitor. | ACCOUNT |
| snowflake.warehouse.execution_state | The execution state of the warehouse. | RUNNING |
| snowflake.warehouse.has_query_acceleration_enabled | Indicates if query acceleration is enabled for the warehouse. | true |
| snowflake.warehouse.is_auto_resume | Indicates if the warehouse is set to auto -resume. |
true |
| snowflake.warehouse.is_auto_suspend | Indicates if the warehouse is set to auto -suspend. |
true |
| snowflake.warehouse.is_current | Indicates if the warehouse is the current warehouse. | true |
| snowflake.warehouse.is_default | Indicates if the warehouse is the default warehouse. | true |
| snowflake.warehouse.is_unmonitored | Indicates if the warehouse is NOT monitored by a resource monitor. | true |
| snowflake.warehouse.owner | The owner of the warehouse. | admin |
| snowflake.warehouse.owner.role_type | The role type of the warehouse owner. | SYSADMIN |
| snowflake.warehouse.scaling_policy | The scaling policy of the warehouse. | STANDARD |
| snowflake.warehouse.size | The size of the warehouse. | X-SMALL |
| snowflake.warehouse.type | The type of the warehouse. | STANDARD |
| snowflake.warehouses.names | The names of the warehouses monitored. | COMPUTE_WH |
| Identifier | Name | Unit | Description | Example |
|---|---|---|---|---|
| snowflake.acceleration.scale_factor.max | Query Acceleration Upper Limit Scale Factor | factor | Maximal scale factor for query acceleration in the given warehouse | 2 |
| snowflake.compute.available | Percentage Available | percent | Percentage of available resources in given warehouse. | 60 |
| snowflake.compute.other | Percentage Other | percent | Percentage of other resources in given warehouse | 10 |
| snowflake.compute.provisioning | Percentage Provisioning | percent | Percentage of provisioning resources in given warehouse. | 20 |
| snowflake.compute.quiescing | Percentage Quiescing | percent | Percentage of quiescing resources in given warehouse. | 10 |
| snowflake.credits.quota | Credits Quota | credits | Total number of credits allowed for the given resource monitor | 1000 |
| snowflake.credits.quota.remaining | Credits Remaining | credits | Number of credits remaining for the given resource monitor | 250 |
| snowflake.credits.quota.used | Credits Used | credits | Number of credits used by the given resource monitor | 750 |
| snowflake.credits.quota.used_pct | Percentage Quota Used | percent | Percentage of quota used by given resource monitor | 75 |
| snowflake.queries.queued | Queued Queries | queries | Current number of queued queries in the given warehouse | 5 |
| snowflake.queries.running | Running Queries | queries | Current number of running queries in the given warehouse | 15 |
| snowflake.resource_monitor.warehouses | Warehouses Count | warehouses | Number of warehouses monitored by the given resource monitor | 5 |
| snowflake.warehouse.clusters.max | Maximum Cluster Count | clusters | Maximal number of clusters in the given warehouse | 10 |
| snowflake.warehouse.clusters.min | Minimum Cluster Count | clusters | Minimal number of clusters in the given warehouse | 1 |
| snowflake.warehouse.clusters.started | Started Clusters | clusters | Current number of started clusters in the given warehouse | 3 |
| Identifier | Description | Example |
|---|---|---|
| snowflake.event.trigger | Additionally to sending logs, each entry in EVENT_TIMESTAMPS is sent as event with key set to snowflake.event.trigger, value to key from EVENT_TIMESTAMPS and timestamp set to the key value. |
snowflake.warehouse.resumed_on |
| snowflake.resource_monitor.created_on | The timestamp when the resource monitor was created. | 2024-10-15 12:34:56.789 |
| snowflake.resource_monitor.end_time | The timestamp when the resource monitor ended. | 2024-11-30 23:59:59.999 |
| snowflake.resource_monitor.start_time | The timestamp when the resource monitor started. | 2024-11-01 00:00:00.000 |
| snowflake.warehouse.created_on | The timestamp when the warehouse was created. | 2024-09-01 08:00:00.000 |
| snowflake.warehouse.resumed_on | The timestamp when the warehouse was last resumed. | 2024-11-15 09:00:00.000 |
| snowflake.warehouse.updated_on | The timestamp when the warehouse was last updated. | 2024-11-10 14:30:00.000 |
This plugin delivers telemetry in multiple contexts. To filter by one of plugin's context names (reported as dsoa.run.context), please check the Context Name column below.
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| db.collection.name | Name of the shared Snowflake table. | SALES_DATA | inbound_shares |
| db.namespace | Name of the database used to store shared data. | DEV_DB | outbound_shares, inbound_shares |
| snowflake.grant.name | Name of the grant to a share. | READ_ACCESS | outbound_shares |
| snowflake.schema.name | Name of the schema where the table is located. | PUBLIC | inbound_shares |
| snowflake.share.name | Name of the share. | SAMPLE_DATA | outbound_shares, inbound_shares |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| snowflake.data.rows | Number of rows in the table. | 20000 | inbound_shares |
| snowflake.data.size | Number of bytes accessed by a scan of the table. | 800000 | inbound_shares |
| snowflake.grant.by | Shows the name of the account which made the grant. | ACCOUNTADMIN | outbound_shares |
| snowflake.grant.grantee | Shows the grantee account name. | PARTNER_ACCOUNT | outbound_shares |
| snowflake.grant.on | Shows on what type of object the grant was made. | DATABASE | outbound_shares |
| snowflake.grant.option | Indicates if grant option is available. | False | outbound_shares |
| snowflake.grant.privilege | Shows the type of privilege granted. | USAGE | outbound_shares |
| snowflake.grant.to | Shows to what the grant was made. | SHARE | outbound_shares |
| snowflake.share.has_db_deleted | Indicates whether DB related to that INBOUND share has been deleted. | False | inbound_shares |
| snowflake.share.has_details_reported | Indicates whether or not details on this share should be reported. | False | inbound_shares |
| snowflake.share.is_secure_objects_only | Indicates if the share is only for secure objects. | True | outbound_shares, inbound_shares |
| snowflake.share.kind | Indicates the type of share. | OUTBOUND | outbound_shares, inbound_shares |
| snowflake.share.listing_global_name | Global name of the share listing. | GLOBAL_SHARE_NAME | outbound_shares, inbound_shares |
| snowflake.share.owner | Shows the account owning the share. | ACCOUNTADMIN | outbound_shares, inbound_shares |
| snowflake.share.shared_from | Shows the owner account of the share. | SNOWFLAKE | outbound_shares, inbound_shares |
| snowflake.share.shared_to | Shows the account the share was made to. | PARTNER_ACCOUNT | outbound_shares, inbound_shares |
| snowflake.table.clustering_key | Clustering key for the table. | DATE | inbound_shares |
| snowflake.table.comment | Comment for this table. | The tables defined in this database that are accessible to the current user's role. | inbound_shares |
| snowflake.table.is_auto_clustering_on | Indicates whether automatic clustering is enabled for the table. | YES | inbound_shares |
| snowflake.table.is_dynamic | Indicates whether the table is a dynamic table. | NO | inbound_shares |
| snowflake.table.is_hybrid | Indicates whether this is a hybrid table. | False | inbound_shares |
| snowflake.table.is_iceberg | Indicates whether the table is an Iceberg table. | NO | inbound_shares |
| snowflake.table.is_temporary | Indicates whether this is a temporary table. | NO | inbound_shares |
| snowflake.table.is_transient | Indicates whether this is a transient table. | NO | inbound_shares |
| snowflake.table.last_ddl_by | The current username for the user who executed the last DDL operation. | DBA_USER | inbound_shares |
| snowflake.table.owner | Name of the role that owns the table. | ACCOUNTADMIN | inbound_shares |
| snowflake.table.retention_time | Number of days that historical data is retained for Time Travel. | 5 | inbound_shares |
| snowflake.table.type | Indicates the table type. | BASE TABLE | inbound_shares |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| snowflake.event.trigger | Additionally to sending logs, each entry in EVENT_TIMESTAMPS is sent as event with key set to snowflake.event.trigger, value to key from EVENT_TIMESTAMPS and timestamp set to the key value. |
snowflake.grant.created_on | outbound_shares, inbound_shares |
| snowflake.grant.created_on | Timestamp of the date of creating the grant. | 1639051180946000000 | outbound_shares |
| snowflake.share.created_on | Timestamp of the date of creating the share. | 1639051180714000000 | outbound_shares, inbound_shares |
| snowflake.table.created_on | Creation time of the table. | 1649940827875000000 | inbound_shares |
| snowflake.table.ddl | Timestamp of the last DDL operation performed on the table or view. | 1639940327875000000 | inbound_shares |
| snowflake.table.update | Date and time the object was last altered by a DML, DDL, or background metadata operation. | 1649962827875000000 | inbound_shares |
This plugin delivers telemetry in multiple contexts. To filter by one of plugin's context names (reported as dsoa.run.context), please check the Context Name column below.
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| db.namespace | The name of the database. | PROD_DB | serverless_tasks, task_versions, task_history |
| snowflake.schema.name | The name of the schema. | public | serverless_tasks, task_versions, task_history |
| snowflake.task.name | The name of the task. | daily_backup_task | serverless_tasks, task_versions, task_history |
| snowflake.warehouse.name | The name of the warehouse. | COMPUTE_WH | task_versions |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| db.query.text | The text of the query. | SELECT * FROM users; | task_versions |
| snowflake.database.id | The unique identifier for the database. | db123 | serverless_tasks, task_versions |
| snowflake.error.code | The error code returned by the task. | ERR123 | task_history |
| snowflake.error.message | The error message returned by the task. | Syntax error | task_history |
| snowflake.query.hash | The hash of the query. | hash123 | task_history |
| snowflake.query.hash_version | The version of the query hash. | v1 | task_history |
| snowflake.query.id | The unique identifier for the query. | query123 | task_history |
| snowflake.query.parametrized_hash | The parameterized hash of the query. | param_hash123 | task_history |
| snowflake.query.parametrized_hash_version | The version of the parameterized query hash. | v1 | task_history |
| snowflake.schema.id | The unique identifier for the schema. | schema123 | serverless_tasks, task_versions |
| snowflake.task.condition | The condition text of the task. | status = 'SUCCESS' | task_versions, task_history |
| snowflake.task.config | The configuration of the task. | config123 | task_history |
| snowflake.task.config.allow_overlap | Indicates if overlapping execution is allowed. | true | task_versions |
| snowflake.task.end_time | The end time of the task. | 1633046700000000000 | serverless_tasks |
| snowflake.task.error_integration | The error integration for the task. | error_integration123 | task_versions |
| snowflake.task.graph.root_id | The root ID of the task graph. | root123 | task_versions, task_history |
| snowflake.task.graph.version | The version of the task graph. | v1 | task_versions, task_history |
| snowflake.task.id | The unique identifier for the task. | task123 | serverless_tasks, task_versions |
| snowflake.task.instance_id | The unique identifier for the task instance. | instance123 | serverless_tasks |
| snowflake.task.last_committed_on | The last committed time of the task. | 1633046400000000000 | task_versions |
| snowflake.task.last_suspended_on | The last suspended time of the task. | 1633046700000000000 | task_versions |
| snowflake.task.owner | The owner of the task. | admin | task_versions |
| snowflake.task.predecessors | The predecessors of the task. | taskA, taskB | task_versions |
| snowflake.task.run.attempt | The attempt number of the task run. | 1 | task_history |
| snowflake.task.run.completed_time | The completed time of the task run. | 1633046700000000000 | task_history |
| snowflake.task.run.group_id | The group ID of the task run. | group123 | task_history |
| snowflake.task.run.id | The unique identifier for the task run. | run123 | task_history |
| snowflake.task.run.return_value | The return value of the task run. | 0 | task_history |
| snowflake.task.run.scheduled_from | The source from which the task was scheduled. | CRON | task_history |
| snowflake.task.run.scheduled_time | The scheduled time of the task run. | 1633046400000000000 | task_history |
| snowflake.task.run.state | The state of the task run. | RUNNING | task_history |
| snowflake.task.schedule | The schedule of the task. | 0 0 * * * |
task_versions |
| snowflake.task.start_time | The start time of the task. | 1633046400000000000 | serverless_tasks |
| Identifier | Name | Unit | Description | Example | Context Name |
|---|---|---|---|---|---|
| snowflake.credits.used | Snowflake Credits Used | credits | Number of credits billed for serverless task usage during the START_TIME and END_TIME window. | 10 | serverless_tasks |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| snowflake.event.trigger | Additionally to sending logs, each entry in EVENT_TIMESTAMPS is sent as event with key set to snowflake.event.trigger, value to key from EVENT_TIMESTAMPS and timestamp set to the key value. |
snowflake.task.graph.version.created_on | task_versions |
| snowflake.task.graph.version.created_on | The creation time of the task graph version. | 1633046400000000000 | task_versions |
All telemetry delivered by this plugin is reported as dsoa.run.context == "trust_center".
| Identifier | Description | Example |
|---|---|---|
| event.category | The category of the event, such as 'Warning' or 'Vulnerability management', based on the severity. | Warning |
| snowflake.trust_center.scanner.id | The unique identifier for the scanner used in the Trust Center. | scanner123 |
| snowflake.trust_center.scanner.package.id | The unique identifier for the scanner package used in the Trust Center. | package123 |
| snowflake.trust_center.scanner.type | The type of scanner used in the Trust Center, such as 'CIS Benchmarks' or 'Threat Intelligence'. | CIS Benchmarks |
| vulnerability.risk.level | The risk level of the vulnerability, such as LOW, MEDIUM, HIGH, or CRITICAL. | HIGH |
| Identifier | Description | Example |
|---|---|---|
| error.code | The error code associated with the scanner, if any. | ERR001 |
| event.id | A unique identifier for the security event. | event123 |
| event.kind | The kind of event, in this case, 'SECURITY_EVENT'. | SECURITY_EVENT |
| snowflake.entity.details | Additional details about the entity involved in the event. | Contains user data |
| snowflake.entity.id | The unique identifier for the entity involved in the event. | entity123 |
| snowflake.entity.name | The name of the entity involved in the event. | User Table |
| snowflake.entity.type | The type of entity involved in the event, such as a table, view, or user. | table |
| snowflake.trust_center.scanner.description | A short description of the scanner used in the Trust Center. | Ensure monitoring and alerting exist for password sign-in without MFA |
| snowflake.trust_center.scanner.name | The name of the scanner used in the Trust Center. | 2.4 |
| snowflake.trust_center.scanner.package.name | The name of the scanner package used in the Trust Center. | CIS Package |
| status.message | The name and description of the scanner, providing additional details about the status. | 2.4 Ensure monitoring and alerting exist for password sign-in without MFA |
| Identifier | Name | Unit | Description | Example |
|---|---|---|---|---|
| snowflake.trust_center.findings | Trust Center Findings Count | count | The total number of findings at risk identified by the scanner. | 10 |
All telemetry delivered by this plugin is reported as dsoa.run.context == "users".
| Identifier | Description | Example |
|---|---|---|
| db.user | Snowflake user who issued the query. | admin |
| Identifier | Description | Example |
|---|---|---|
| snowflake.user.bypass_mfa_until | The time until which the user can bypass MFA. | 2024-11-06T00:00:00Z |
| snowflake.user.comment | Any comments associated with the user. | New user account |
| snowflake.user.created_on | The creation time of the user account. | 1651830381846000000 |
| snowflake.user.default.namespace | The default namespace for the user. | PUBLIC |
| snowflake.user.default.role | The default role for the user. | SYSADMIN |
| snowflake.user.default.secondary_role | The default secondary role for the user. | SECURITYADMIN |
| snowflake.user.default.warehouse | The default warehouse for the user. | COMPUTE_WH |
| snowflake.user.deleted_on | The deletion time of the user account, if applicable. | 1615219846384000000 |
| snowflake.user.display_name | The display name of the user. | John Doe |
| snowflake.user.email | The email address of the user. | jdoe@example.com |
| snowflake.user.expires_at | The expiration date of the user account. | 1620213179885000000 |
| snowflake.user.ext_authn.duo | Indicates if Duo authentication is enabled for the user. | true |
| snowflake.user.ext_authn.uid | The external authentication UID for the user. | ext123 |
| snowflake.user.has_password | Indicates if the user has a password set. | true |
| snowflake.user.id | The unique identifier for the user. | 12345 |
| snowflake.user.is_disabled | Indicates if the user account is disabled. | false |
| snowflake.user.is_locked | Indicates if the user account is locked by Snowflake. | false |
| snowflake.user.last_success_login | The last successful login time of the user. | 1732181350954000000 |
| snowflake.user.locked_until_time | The time until which the user account is locked. | 1615479617866000000 |
| snowflake.user.must_change_password | Indicates if the user must change their password. | true |
| snowflake.user.name | The login name of the user. | jdoe |
| snowflake.user.name.first | The first name of the user. | John |
| snowflake.user.name.last | The last name of the user. | Doe |
| snowflake.user.owner | The role that owns the user account. | ACCOUNTADMIN |
| snowflake.user.password_last_set_time | The last time the user's password was set. | 1615219848053000000 |
| snowflake.user.privilege | Name of the privilege and type of object this privilege granted on to the user or role. Composed as privilege:granted_on_object. |
CREATE SERVICE:SCHEMA |
| snowflake.user.privilege.granted_by | Array of all roles which granted grants to a user for a privilege. | ['ACCOUNTADMIN'] |
| snowflake.user.privilege.grants_on | List of all objects of given type on which given privilege was given; both object type and privilege are reported as snowflake.user.privilege |
['TRUST_CENTER_ADMIN', 'COMPUTE_WH'] |
| snowflake.user.privilege.last_altered | Nanosecond timestamp of the last alteration to user's privileges. | 1732181350954000000 |
| snowflake.user.roles.all | Comma separated list of all roles granted to a user. | SNOWFLAKE_FINANCE,MONITORING |
| snowflake.user.roles.direct | List of all direct roles granted to user. | ['DEVOPS_ROLE', 'SYSADMIN', 'ACCOUNTADMIN'] |
| snowflake.user.roles.direct.removed | Name of the role that was revoked from user. | ACCOUNTADMIN |
| snowflake.user.roles.direct.removed_on | Nanosecond timestamp of the last deletion of a direct role to a user. | 1718260900411000000 |
| snowflake.user.roles.granted_by | Array of admin roles that were used to grant current list of user roles. | ['DEMIGOD', 'SECURITYADMIN', 'ACCOUNTADMIN'] |
| snowflake.user.roles.last_altered | Nanosecond timestamp of last alteration of roles granted to user. | 1718260900411000000 |
| snowflake.user.type | Specifies the type of user | LEGACY_SERVICE |
This plugin delivers telemetry in multiple contexts. To filter by one of plugin's context names (reported as dsoa.run.context), please check the Context Name column below.
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| snowflake.warehouse.event.name | The name of the event. | WAREHOUSE_START | warehouse_usage |
| snowflake.warehouse.event.state | The state of the event, such as STARTED or COMPLETED. | STARTED | warehouse_usage |
| snowflake.warehouse.name | The name of the warehouse. | COMPUTE_WH | warehouse_usage, warehouse_usage_load, warehouse_usage_metering |
| Identifier | Description | Example | Context Name |
|---|---|---|---|
| db.user | The user who initiated the event. | admin | warehouse_usage |
| snowflake.query.id | The unique identifier for the query associated with the event. | query123 | warehouse_usage |
| snowflake.role.name | The role name associated with the event. | SYSADMIN | warehouse_usage |
| snowflake.warehouse.cluster.number | The number of the cluster within the warehouse. | 1 | warehouse_usage |
| snowflake.warehouse.clusters.count | The number of clusters in the warehouse. | 2 | warehouse_usage |
| snowflake.warehouse.event.reason | The reason for the event. | USER_REQUEST | warehouse_usage |
| snowflake.warehouse.id | The unique identifier for the warehouse. | wh123 | warehouse_usage, warehouse_usage_load, warehouse_usage_metering |
| snowflake.warehouse.size | The size of the warehouse. | X-SMALL | warehouse_usage |
| Identifier | Name | Unit | Description | Example | Context Name |
|---|---|---|---|---|---|
| snowflake.credits.cloud_services | Cloud Services Credits Used | credits | The number of credits used for cloud services. | 2 | warehouse_usage_metering |
| snowflake.credits.compute | Compute Credits Used | credits | The number of credits used for compute. | 8 | warehouse_usage_metering |
| snowflake.credits.used | Snowflake Credits Used | credits | The total number of credits used by the warehouse. | 10 | warehouse_usage_metering |
| snowflake.load.blocked | Average Blocked Queries | count | The average number of queries blocked by a transaction lock. | 0 | warehouse_usage_load |
| snowflake.load.queued.overloaded | Average Queued Queries (Load) | count | The average number of queries queued due to load. | 2 | warehouse_usage_load |
| snowflake.load.queued.provisioning | Average Queued Queries (Provisioning) | count | The average number of queries queued due to provisioning. | 1 | warehouse_usage_load |
| snowflake.load.running | Average Running Queries | count | The average number of running queries. | 5 | warehouse_usage_load |