The system dataspace
The system dataspace provides powerful visibility into the structure, behavior, and configuration of your organization's data. You can track how schemas evolve, review alert activity, and inspect audit events — all of which support debugging, auditing, and operational insight.
Unlike user-defined dataspaces, the system dataspace is maintained by Coralogix and contains internal metadata related to your environment.
Note
Logs generated by Coralogix for the system dataspace count toward your daily quota. However, these datasets typically contain low-volume data, so performance and cost impact should be minimal.
Overview
The system dataspace sits apart from general user-generated dataspaces. It contains datasets defined by Coralogix, and is designed to help you understand how your data is structured, how alerts behave over time, and how your environment is changing internally.
You can access this dataspace just like any other in DataPrime using the source keyword:
Example: filtering schema changes
Using DataPrime, the engine.schema_fields dataset can be queried to find datasets with P1 alerts that have changed structure recently:
Query behavior and capabilities
All system datasets support full DataPrime functionality — you can filter, aggregate, group, and visualize them like any other dataset. This makes them suitable for use in:
- Explore queries
- Custom Dashboards
- Automated reports
These datasets are especially valuable when paired with historical analysis tools or anomaly detection logic, such as tracking the rate of schema change or alert frequency over time.
Datasets
| Dataset | Description |
|---|---|
| aaa.audit_events | Audit trail of system activity for compliance and access monitoring. |
| alerts.history | History of alert evaluations and trigger events. |
| engine.queries | Historical record of user queries for introspection and optimization. |
| engine.schema_fields | Tracks field-level schema evolution over time. |
| labs.limit_violations | Records each time a configured limit is exceeded. |
| notification.deliveries | Logs Notification Center delivery events. Alerts record delivery failures; Cases record both successful and failed deliveries. |
| notification.requests | Captures each incoming notification request. |