Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fsystem_dataspace%2Fsystem-datasets.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fsystem_dataspace%2Fsystem-datasets.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# System datasets

System datasets live in the [`system` dataspace](https://coralogix.com/docs/user-guides/data-layer/system_dataspace.md). Coralogix creates and maintains them, and they record activity inside your Coralogix account, such as alert history, audit events, and quota consumption. They are read-only: you query them, but you can't write to them.

Enable a system dataset before you query it. In **Data Flow**, open **Dataset Management**, select the **System** tab, and turn on write access for the dataset.

| Dataset                                                                                                                    | Description                                                                                                                    |
| -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| [`aaa.audit_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/aaa_audit-events.md)               | Audit trail of system activity for compliance and access monitoring.                                                           |
| [`alerts.history`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/alerts-history.md)                   | History of alert evaluations and trigger events.                                                                               |
| [`engine.queries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine_queries.md)                   | Historical record of user queries for introspection and optimization.                                                          |
| [`engine.schema_fields`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine-schema_fields.md)       | Tracks field-level schema evolution over time.                                                                                 |
| [`labs.limitViolations`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/labs_limit-violations.md)      | Records each time a configured limit is exceeded.                                                                              |
| [`notification.deliveries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/notification_deliveries.md) | Logs Notification Center delivery events. Alerts record delivery failures; Cases record both successful and failed deliveries. |
| [`dataplan.quota_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/quota_events.md)              | Stream of quota-related events, allocations, consumption, and threshold breaches.                                              |
| [`dataplan.usage_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/dataplan-usage-events.md)     | Aggregated team data usage events, after unit ratios are applied.                                                              |

Each dataset page describes the dataset and lists its fields. Every system dataset carries the same record envelope: engine metadata in `$m`, labels in `$l`, and the dataset-specific payload in `$d`. See [Entity types](https://coralogix.com/docs/user-guides/data-layer/entity-types.md) for how the envelope works.

## Query a system dataset[​](#query-a-system-dataset "Direct link to Query a system dataset")

Reference a system dataset by its dataspace and name:

```
source system/engine.queries
```

All system datasets support full DataPrime functionality. You can filter, aggregate, group, and visualize them in Explore queries, Custom Dashboards, and automated reports. Their events count toward your daily quota, but volumes are typically small compared to your own data.

## Next steps[​](#next-steps "Direct link to Next steps")

* Learn how the `system` dataspace fits alongside your own data in [The `system` dataspace](https://coralogix.com/docs/user-guides/data-layer/system_dataspace.md).
* Manage access to system datasets in [Dataset management](https://coralogix.com/docs/user-guides/data-layer/dataset-management.md).