Menu Close Get Metabase

Auditing your users and data

Nov 20, 2020 by The Metabase Team

Auditing is a Metabase Enterprise Edition feature that gives admins insight into how people are using their Metabase instance.

<em>Fig. 1.</em> The team members' <strong>audit logs</strong>, which lets admins see how people are using Metabase.
Fig. 1. The team members' audit logs, which lets admins see how people are using Metabase.

We’ll use the Sample Dataset included with Metabase to walk though some examples of how these auditing tools can help us:

  • See who’s looking at what data.
  • Identify opportunities to speed up your dashboards and queries.

These auditing tools are a must-have for managing compliance requirements, but they can also help us make the most out of our data.

See who’s looking at what data

In the top right of the Metabase nav bar, we’ll click on the gear icon and select Admin. Once in Metabase Admin, we’ll click the Audit tab on the purple nav bar.

Who’s had access to the People table?

The audit logs can help us verify that our data and collection permissions work as intended. The audit logs record each table and question people view, which allows us to confirm that we’re adhering to compliance requirements like HIPAA.

Let’s say we want to see who’s accessed the People table. We’ll select Tables in the audit sidebar.

If we hover over the bar for “Sample Dataset PUBLIC PEOPLE”, Metabase will display a tooltip with the specific number of queries from the table. Clicking the bar will drill through to an audit log for the table.

<em>Fig. 2.</em> The tables overview page with the mouse hovering over the PUBLIC PEOPLE item in the bar chart.
Fig. 2. The tables overview page with the mouse hovering over the PUBLIC PEOPLE item in the bar chart.

The table audit log contains three columns:

  • Queried by: person who ran the question.
  • Query: the execution/viewing of a question.
  • Viewed on: when the question was last viewed.

The table audit log orders its rows by Viewed on date and time, with the most recently viewed queries on top.

<em>Fig. 3.</em> The <strong>audit log</strong> for the <strong>People</strong> table.
Fig. 3. The audit log for the People table.

From the table audit log, we can see that the admin isn’t the only person who’s viewed the People table. If Dr. Orange is not supposed to have access to the People table, we could do a deeper dive and audit Dr. Orange’s account, see what queries they’ve been viewing, revoke their access in data permissions, archive any wayward queries in collections Dr. Orange has access to, and talk to them about the data they’d been viewing.

Note that if someone used a Native query (like a SQL question) to access the People table, we wouldn’t see it here. All Metabase can know about native queries is the database it queries, so we’d have to check each query individually. So be intentional about who you add to groups with SQL query access to your databases.

What has Ms. Brown seen recently?

Ms. Brown recently quit the company and we want to check what data she was looking at during her last week of employment.

To see what data people have viewed, we’ll use the sidebar on the left to select Team members.

The overview tab gives us a good idea of who our most active Metabase users are (Figure 4).

<em>Fig. 4.</em> The two graphs on the overview tab on the Team members page.
Fig. 4. The two graphs on the overview tab on the Team members page.

To check Ms. Brown’s activity, we’ll click the All members tab. The members list includes the name, groups, date joined, last active date, and signup method of each user.

<em>Fig. 5.</em>  Ms. Green user appearing as the only result for the 'Mr. Brown' search.
Fig. 5. Ms. Green user appearing as the only result for the 'Mr. Brown' search.

We’ll click on Ms. Brown’s name to drill through to detailed information about her actions in Metabase (Figure 6). The user page charts the user’s activity highlights, query views, dashboard views, and downloaded items.

<em>Fig. 6.</em>  Ms. Brown's specific audit pages open to the Query views tab.
Fig. 6. Ms. Brown's specific audit pages open to the Query views tab.

How much data are people downloading?

Let’s go to the Downloads section and look at the overview tab.

From the first chart (Figure 7), we can see that only four questions have been downloaded. From the chart on the bottom left, we can see which users have been downloading that data.

<em>Fig. 7.</em> The <strong>Overview</strong> tab for the <strong>Downloads</strong> section showing three graphs.
Fig. 7. The Overview tab for the Downloads section showing three graphs.

One of Dr. Orange’s downloads was pretty big (for the Sample Dataset, at least): 1,112 rows of data. Click on the All downloads tab to see what Dr. Orange downloaded that had so many rows.

<em>Fig. 8.</em> The <strong>audit log</strong> for the downloads section.
Fig. 8. The audit log for the downloads section.

Towards the top of the list we can see that Dr. Orange’s download was a query titled Reviews. If we want more information, we can click into the question and Open in Metabase.

<em>Fig. 9.</em> The Reviews question with a hover over the <strong>Open in Metabase</strong> button at the top of the screen.
Fig. 9. The Reviews question with a hover over the Open in Metabase button at the top of the screen.

Optimizing our Metabase instance

We can also use the audit logs to find opportunities to make our dashboards load faster, or help people find the data they need by making sure people are using dashboards they can trust.

Why is CA Marketing Dashboard loading slowly?

Let’s say there have been some complaints about the CA Marketing Dashboard’s sloth-like load times.

In Audit’s Databases section, we can see a summary of total queries and their average run time.

<em>Fig. 10.</em> The Databases Overview tab and the two graphs that appear there.
Fig. 10. The Databases Overview tab and the two graphs that appear there.

The Sample Database’s load time is less than a second, so we know the database at large isn’t slowing anything down. Maybe the loading problem is with the dashboard itself?

Let’s go to the Dashboards section and select CA Marketing Dashboard from the graph of most popular dashboards. In the dashboards’ personalized page, we can see that this dashboard does indeed take a while to load, so we’ll click on the Revision history tab to see what changes people have made to the dashboard that might have affected load times.

<em>Fig. 11.</em> The revision history for the CA Marketing Dashboard.
Fig. 11. The revision history for the CA Marketing Dashboard.

Here we can see that a user recently added a card to the dashboard. That card is probably what’s slowing down the dashboard.

Did pinning Important People increase its views?

Let’s say we recently pinned a key question, “Important People”, to its collection, and want to see if pinning it has helped drive traffic to the question.

In the Questions section’s Overview tab, we’ll see two charts - the most popular queries and the slowest loading queries.

<em>Fig. 12.</em> Two of the graphs on the <strong>Overview</strong> tab.
Fig. 12. Two of the graphs on the Overview tab.

To find a specific questions, we’ll open the All questions tab and select Important People from the list.

We pinned this question to its collection in late October. We can see by the chart in the Activity tab that pinning has helped get the word out about our dashboard.

<em>Fig. 13.</em> The Important People question-specific page.
Fig. 13. The Important People question-specific page.

Try out Metabase Enterprise Edition and see what else auditing has to offer your team! For more information, read the audit documentation.