Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fsystem_dataspace.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fsystem_dataspace.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# The `system` dataspace

The `system` dataspace provides powerful visibility into the structure, behavior, and configuration of your organization's data. You can track how schemas evolve, review alert activity, and inspect audit events — all of which support debugging, auditing, and operational insight.

Unlike user-defined dataspaces, the `system` dataspace is maintained by Coralogix and contains internal metadata related to your environment.

Note

Logs generated by Coralogix for the system dataspace **count toward your daily quota**. However, these datasets typically contain low-volume data, so performance and cost impact should be minimal.

## Overview[​](#overview "Direct link to Overview")

The `system` dataspace sits apart from general user-generated dataspaces. It contains datasets defined by Coralogix, and is designed to help you understand how your data is structured, how alerts behave over time, and how your environment is changing internally.

You can access this dataspace just like any other in DataPrime using the `source` keyword:

```
source system/engine.schema_fields
```

### Example: filtering schema changes[​](#example-filtering-schema-changes "Direct link to Example: filtering schema changes")

Using DataPrime, the `engine.schema_fields` dataset can be queried to find datasets with P1 alerts that have changed structure recently:

```
source system/engine.schema_fields

| filter alert.priority == "P1"
```

### Query behavior and capabilities[​](#query-behavior-and-capabilities "Direct link to Query behavior and capabilities")

All `system` datasets support full DataPrime functionality — you can filter, aggregate, group, and visualize them like any other dataset. This makes them suitable for use in:

* **Explore** queries
* **Custom Dashboards**
* **Automated reports**

These datasets are especially valuable when paired with historical analysis tools or anomaly detection logic, such as tracking the rate of schema change or alert frequency over time.

## Datasets[​](#datasets "Direct link to Datasets")

| Dataset                                                                                                                        | Description                                                                                                                    |
| ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ |
| [aaa.audit\_events](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/aaa_audit-events/.md)              | Audit trail of system activity for compliance and access monitoring.                                                           |
| [alerts.history](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/alerts-history/.md)                   | History of alert evaluations and trigger events.                                                                               |
| [engine.queries](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/engine_queries/.md)                   | Historical record of user queries for introspection and optimization.                                                          |
| [engine.schema\_fields](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/engine-schema_fields/.md)      | Tracks field-level schema evolution over time.                                                                                 |
| [labs.limit\_violations](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/labs_limit-violations/.md)    | Records each time a configured limit is exceeded.                                                                              |
| [notification.deliveries](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/notification_deliveries/.md) | Logs Notification Center delivery events. Alerts record delivery failures; Cases record both successful and failed deliveries. |
| [dataplan.quota\_events](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/quota_events/.md)             | Stream of quota-related events — allocations, consumption, and threshold breaches.                                             |
| [dataplan.usage\_events](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/dataplan-usage-events/.md)    | Aggregated team data usage events, after unit ratios are applied.                                                              |