Apache Doris Query Audit Evidence for Open Lakehouse Serving

A fast serving layer is useful until no one can explain who ran the expensive query, which data it touched, or why freshness changed.

Serving needs a record

Apache Doris documents audit logging for database operations, including logins, queries, and modification operations. Doris also exposes audit log information through system tables and log files, depending on version and configuration.

That is the beginning of evidence, not the end. Open lakehouse serving has more context than a single query string. The platform needs user identity, workload identity, source catalog, source tables, snapshot or refresh state, runtime cost, denial decisions, and incident notes when something breaks.

Audit evidence has to be joined

Query audit records are most useful when they can be joined to data product metadata. A slow query matters more when it is tied to a customer-facing data product. A denied query matters more when it exposes a policy gap. A successful query still matters when an agent used it to make an operational decision.

The serving engine should not become a black box at the edge of the open lakehouse. It should emit enough evidence for the catalog, lineage system, and reliability process to reconstruct the path.

The ODI audit pattern

Open Data Infrastructure should connect serving-layer query evidence with catalog identity, source table state, freshness SLAs, workload budgets, and incident response. That turns audit logs from after-the-fact search into an operating surface.

For adjacent context, read Apache Doris on open lakehouse tables, Doris materialized view refresh evidence, and access logs as evaluation evidence.

What breaks first

• Audit logs record SQL but not the data product, owner, or policy context.
• Slow query analysis happens separately from catalog and freshness evidence.
• Agent queries look like service-account noise rather than explainable workload events.
• Incident review stops at the serving engine and never reaches source table state.

Questions to ask

Ask which audit fields are retained, how long they are kept, and how they map to catalog identities. Ask whether query records can connect to source table snapshots, materialized view refreshes, and data product owners.

Serving is governed only when the query path can testify.

Sources to start with

These primary sources anchor the technical claims in this guide.

• Apache Doris audit log documentation
• Apache Doris audit_log system table documentation
• Apache Doris diagnostic tools documentation
• OpenLineage object model documentation

The query log is not paperwork. It is the serving layer telling the truth.