Activity Log Event Type Reference

The following tables describe the Activity Log event types and attributes.

Event type details

The following content describes each event type in Activity Log. Use the alphabetically sorted list of event types on the right, or ctrl/cmd-f to go directly to keywords you have in mind.

Note: Timestamps for events are recorded in ISO 8601 UTC.

Common attributes

The following table contains common attributes for all Activity Log events. For event-specific attributes, review the individual event tables.

Attribute NameTypeDescription
actorUserIdintegerID of the user who performed the action that initiated the event
actorUserLuidstringLUID of the user who performed the action that initiated the event
eventTimestringTimestamp when the event occurred
initiatingUserIdintegerID of the initiating user. For impersonation, it's the ID of the administrative user who initiated impersonation. For standard login, the value is the same as userId.
initiatingUserLuidstringLUID of the initiating user. For impersonation, it's the LUID of the administrative user who initiated impersonation. For standard login, the value is the same as userLuid.
licensingRoleNamestringName of the user's licensing role when the event occurred
serviceNamestringName of service that initiated the event, such as vizportal, vizqlserver or sitesaml.
siteLuidstringLUID of the Tableau site where the event occurred
siteRoleIdintegerThe user's site role ID. The value 0 = SiteAdministratorExplorer, 1 = SupportUser, 2 = ExplorerCanPublish, 3 = Explorer, 7 = Guest, 8 = Unlicensed, 9 = Viewer, 10 = Creator, and 11 = SiteAdministratorCreator.
systemAdminLevelintegerIndicates if the user is a system administrator. The value 10 = System Admin and 0 = Not a system admin.

add_delete_user_to_group

The add_delete_user_to_group event is logged when a user is added or removed from a group.

Attribute NameTypeDescription
groupIDintegerThe ID of the group
groupLuidstringThe LUID of the group
groupOperationstringGroup operation, either add or delete user to a group
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
userIdintegerThe ID of the user
userLuidstringThe LUID of the user

background_job

The background_job event logs information about jobs run as background tasks. For each job, an event is created to record its various states, including initiation time, queueing, start time and success or failure.

Attribute NameTypeDescription
argsstringArguments of the job
durationlongDuration of the job
eventInitiatedTimestringStart time of the job
eventStatestring

State of the job

isRunNowbool

Indicates whether the job was initiated manually, by clicking the ‘Run Now’ option on the site or using REST API, or if it was triggered by a schedule.

Note: Starting in April 2024, jobs triggered by a schedule (False) include data for all attributes listed in the table. Attributes for jobs initiated manually (True) are under active development and tentatively scheduled for inclusion in a future release.

jobIdintegerID of the job
jobLuidstringLUID of the job
jobTypestring

Identifies the background job type associated with the event

Note: Starting in April 2024, only the IncrementExtracts, RefreshExtracts and RefreshExtractsViaBridge jobs include data for all attributes listed in the table. Attributes for other job types are under active development and tentatively scheduled for inclusion in a future release.

notesstringNotes of the job
objLuidstringSome tasks are specific to a particular workbook or data source. In such cases, the object_luid is the primary key of the relevant item, in either the workbooks or data sources tables, as indicated by obj_type.
objNamestringName of the associated object. Used in conjunction with obj_luid, as described there.
objOwnerLuidstringA foreign key reference to the user who owns the job target object
objOwnerNamestringName of the user who owns the job target object
objRepositoryUrlstring

Uniquely identifies a workbook or data source and is used when referencing the object in a URL. The value is derived from the ASCII characters in the workbook or data source name.

objRevisionstringThe revision number. Starts with 1.0 and increments by 0.1 with each republication.
objSizeintegerThe number of bytes used in storing the job target object information
objTypestringEither a workbook or data source. Used in conjunction with obj_luid.
podNamestringName of the Tableau pod that handled the job
projectLuidstringA foreign key reference to the project in which the job target object exists
projectNamestringName of the project that contains the job target object
projectOwnerEmailstringEmail address of the user who owns the project containing the job target object
projectOwnerLuidstringA foreign key reference to the user who owns the project containing the job target object
scheduleLuidstringSchedule LUID of the task; may be null if the job was manually started
scheduleNamesringSchedule name of the task; may be null if the job was manually started
siteIdintegerID of the site
siteNamestringName of the Tableau site
taskIdintegerID of the task; may be null if the job was manually started.
taskLuidstringLUID of the task; may be null if the job was manually started.
timeZoneintegerTime zone of the job

content_owner_change

The content_owner_change event is logged when the content owner changes.

Attribute NameTypeDescription
contentIdintegerThe ID of the content that had the owner changed
contentLuidstringLUID of the content that had the owner changed
contentNamestringName of the content that had the owner changed
contentTypestringThe type of content, such as data source, workbook or view
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
newOwnerIdintegerThe ID of the new content owner
newOwnerLuidstringThe LUID of the new content owner
oldOwnerIdintegerThe ID of the old content owner
oldOwnerLuidstringThe LUID of the old content owner

create_delete_group

The create_delete_group event is logged when a group is created or deleted.

Attribute NameTypeDescription
groupDomainstringThe domain of the group, such as local
groupIDintegerThe ID of the group
groupLuidstringThe LUID of the group
groupNamestringThe name of the group that had its permissions changed
groupOperationstringGroup operation, either create or delete
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error

create_permissions

The create_permissions event is logged when a new explicit permission rule is created.

Note: Deprecated in October 2024. Use the set_permissions event instead.

Attribute NameTypeDescription
authorisableTypestringThe type of content that had its permissions changed, such as a project or workbook
capabilityIdintegerThe ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete
capabilityValuestringDescription of the capability
contentIdintegerThe ID of the content that had the permissions updated
contentLuidstringThe LUID of the content item
contentNamestringThe name of the content that had the permissions updated
granteeIdintegerThe ID of the grantee
granteeLuidstringThe LUID of the grantee
granteeTypestringThe type of grantee, either user or group
granteeValuestringThe updated permissions value, such as 'user allow' or 'group allow'
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error

delete_all_permissions

The delete_all_permissions event is logged when all explicit permission rules for content are deleted, typically when content is deleted.

Attribute NameTypeDescription
authorisableTypestringThe type of content that had its permissions changed, such as a project or workbook
contentIdintegerThe ID of the content that had the permissions updated
contentLuidstringThe LUID of the content
contentNamestringThe name of the content that had the permissions updated
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error

delete_permissions

The delete_permissions event is logged when an explicit permission rule is deleted on content.

Attribute NameTypeDescription
authorisableTypestringThe type of content that had its permissions changed, such as a project or workbook
capabilityIdintegerThe ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete
capabilityValuestringDescription of the capability
contentIdintegerThe ID of the content that had the permissions updated
contentLuidstringThe LUID of the content
contentNamestringThe name of the content that had the permissions updated
granteeIdintegerThe ID of the grantee
granteeLuidstringThe LUID of the grantee
granteeTypestringThe type of grantee, either user or group
granteeValuestringThe updated permissions value, such as 'user allow' or 'group allow'
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error

delete_permissions_grantee

The delete_permissions_grantee event is logged when all explicit permission rules for a user are deleted, typically when the user is deleted.

Attribute NameTypeDescription
granteeIdintegerThe ID of the grantee
granteeLuidstringThe LUID of the grantee
granteeTypestringThe type of grantee, either user or group
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error

display_sheet_tabs

The display_sheet_tabs event is logged when the "Tabbed Views" value is updated on a workbook.

Attribute NameTypeDescription
displayTabsbooleanIndicates whether sheets of the workbook are displayed as tabs or not
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
workbookIdintegerThe ID of the workbook

move_content

The move_content event is logged when content is moved, for example, moving a workbook between projects.

Attribute NameTypeDescription
contentIdintegerThe ID of the content that had the owner changed
contentLuidstringLUID of the content that had the owner changed
contentNamestringName of the content that had the owner changed
contentTypestringThe type of content, such as data source, workbook or view
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
newContainerLuidstringLUID of the new container
newContainerTypestringThe new container type, such as a project
oldContainerLuidstringLUID of the previous container
oldContainerTypestringThe previous container type, such as a project

project_lock_unlock

The project_lock_unlock event is logged when project permissions are locked or unlocked.

Attribute NameTypeDescription
controllingProjectLuidstringLUID of the project that controls permissions for the nested project
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
projectLuidstringLUID of the project
projectOperationstringProject operation, either lock or unlock

set_permissions

The set_permissions event is logged when an explicit permissions rule is created or updated for a content item.

Attribute NameTypeDescription
authorisableTypestring

The type of content that had its permissions changed, such as project or workbook

capabilityIdintegerThe ID of the capability. A capability is the ability to perform a certain action on a particular piece of content, such as view, filter, download or delete.
capabilityValuestringDescription of the capability
contentIdintegerThe ID of the content that had the permissions set
contentLuidstringThe LUID of the content item
contentNamestringThe name of the content that had the permissions set
granteeIdintegerThe ID of the grantee
granteeLuidstringThe LUID of the grantee
granteeTypestringThe type of grantee, either user or group
granteeValuestringThe set permissions value, such as “user allow” or “group allow”
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
permissionTypestringThe permission type, either explicit or unspecified

site_storage_usage

The site_storage_usage event logs the total storage capacity of the site in bytes, the amount of storage used and the percentage of the total consumed. Administrators can use this data to proactively monitor storage consumption and take action before reaching the site's storage limit.

Attribute NameTypeDescription
actorUsernamestring

Username of the user who performed the action that initiated the event

initiatingUsernamestringUsername of the initiating user
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
totalPercentageStorageQuotaUsedfloatTotal percentage of storage usage
totalStorageQuotaLimitlongTotal storage capacity in bytes
totalStorageQuotaUsedlongTotal storage used in bytes

update_permissions

The update_permissions event is logged when an explicit permission rule is updated for a content item.

Note: Deprecated in October 2024. Use the set_permissions event instead.

Attribute NameTypeDescription
authorisableTypestringThe type of content that had its permissions changed, such as a project or workbook
capabilityIdintegerThe ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete
capabilityValuestringDescription of the capability
contentIdintegerThe ID of the content that had the permissions updated
contentLuidstringThe LUID of the content
contentNamestringThe name of the content that had the permissions updated
granteeIdintegerThe ID of the grantee
granteeLuidstringThe LUID of the grantee
granteeTypestringThe type of grantee, either user or group
granteeValuestringThe updated permissions value, such as 'user allow' or 'group allow'
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
permissionTypestringThe permission type, either explicit or unspecified

update_permissions_template

The update_permissions_template event is logged when a permission template for a project is updated.

Attribute NameTypeDescription
authorisableTypestringThe type of content that had its permissions changed, such as a project or workbook
capabilityIdintegerThe ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete
capabilityValuestringDescription of the capability
contentIdintegerThe ID of the content that had the permissions updated
contentLuidstringThe LUID of the content
contentNamestringThe name of the content that had the permissions updated
granteeIdintegerThe ID of the grantee
granteeLuidstringThe LUID of the grantee
granteeTypestringThe type of grantee, either user or group
granteeValuestringThe updated permissions value, such as 'user allow' or 'group allow'
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
permissionTypestringThe permission type, either explicit or unspecified
templateTypestringThe type of permission template used to change permissions, such as workbook or data source

user_create_delete

The user_create_delete event is logged when a user is created or deleted.

Attribute NameTypeDescription
forUserNamestringThe name of the user whose account was either created, updated or deleted
isErrorbooleanIndicates if the audit scenario was completed successfully or failed with an error
siteRolestringSite role of the user. Determines the maximum level of access a user can have on the site
targetUserIdintegerThe ID of the user whose account was either created, updated or deleted
targetUserLuidstringThe LUID of the user whose account was either created, updated or deleted
userOperationstringThe action performed on a user, either create, delete or site role change