system.user_query_log

​

Description

​

Columns

• hostname (String) — Hostname of the server executing the query.
• type (Enum8(‘QueryStart’ = 1, ‘QueryFinish’ = 2, ‘ExceptionBeforeStart’ = 3, ‘ExceptionWhileProcessing’ = 4)) — Type of an event that occurred when executing the query. Values: QueryStart — successful start of query execution, QueryFinish — successful end of query execution, ExceptionBeforeStart — exception before the start of query execution, ExceptionWhileProcessing — exception during the query execution.
• event_date (Date) — Query starting date.
• event_time (DateTime) — Query starting time.
• event_time_microseconds (DateTime64(6)) — Query starting time with microseconds precision.
• query_start_time (DateTime) — Start time of query execution.
• query_start_time_microseconds (DateTime64(6)) — Start time of query execution with microsecond precision.
• query_duration_ms (UInt64) — Duration of query execution in milliseconds.
• read_rows (UInt64) — Total number of rows read from all tables and table functions participated in query. It includes usual subqueries, subqueries for IN and JOIN. For distributed queries read_rows includes the total number of rows read at all replicas. Each replica sends it’s read_rows value, and the server-initiator of the query summarizes all received and local values. The cache volumes do not affect this value.
• read_bytes (UInt64) — Total number of bytes read from all tables and table functions participated in query. It includes usual subqueries, subqueries for IN and JOIN. For distributed queries read_bytes includes the total number of rows read at all replicas. Each replica sends it’s read_bytes value, and the server-initiator of the query summarizes all received and local values. The cache volumes do not affect this value.
• written_rows (UInt64) — The number of rows written by the query, including any rows written by downstream inserts triggered by the pipeline, such as attached materialized views. For a synchronous insert these downstream rows are recorded on the query_kind = Insert entry; for an asynchronous insert they are recorded on the query_kind = AsyncInsertFlush entry, while the client-facing Insert entry records only the rows accepted from the client. For queries that do not write rows, it is 0.
• written_bytes (UInt64) — The number of bytes written by the query (uncompressed), including any bytes written by downstream inserts triggered by the pipeline, such as attached materialized views. For a synchronous insert these downstream bytes are recorded on the query_kind = Insert entry; for an asynchronous insert they are recorded on the query_kind = AsyncInsertFlush entry, while the client-facing Insert entry records only the bytes accepted from the client. For queries that do not write data, it is 0.
• result_rows (UInt64) — Number of rows in the result of a SELECT query, or the number of rows written by an insert. For a synchronous insert this includes rows written by downstream inserts triggered by the pipeline (such as attached materialized views) on the query_kind = Insert entry; for an asynchronous insert those downstream rows are recorded on the query_kind = AsyncInsertFlush entry, while the client-facing Insert entry records only the rows accepted from the client.
• result_bytes (UInt64) — RAM volume in bytes used to store a query result.
• memory_usage (UInt64) — Memory consumption by the query.
• current_database (String) — Name of the current database.
• query (String) — Query string.
• formatted_query (String) — Formatted query string.
• normalized_query_hash (UInt64) — A numeric hash value, such as it is identical for queries differ only by values of literals.
• query_kind (String) — Type of the query.
• databases (Array(String)) — Names of the databases present in the query.
• tables (Array(String)) — Names of the tables present in the query.
• columns (Array(String)) — Names of the columns present in the query.
• partitions (Array(String)) — Names of the partitions present in the query.
• projections (Array(String)) — Names of the projections used during the query execution.
• views (Array(String)) — Names of the (materialized or live) views present in the query.
• exception_code (Int32) — Code of an exception.
• exception (String) — Exception message.
• stack_trace (String) — Stack trace. An empty string, if the query was completed successfully.
• is_initial_query (UInt8) — Query type. Possible values: 1 — query was initiated by the client, 0 — query was initiated by another query as part of distributed query execution.
• connection_address (IPv6) — The client IP address from which the connection was made. When connected through a proxy, this will be the address of the proxy.
• connection_port (UInt16) — The client port from which the connection was made. When connected through a proxy, this will be the port of the proxy.
• user (String) — Name of the user who initiated the current query.
• query_id (String) — ID of the query.
• address (IPv6) — IP address that was used to make the query. When connected through a proxy and auth_use_forwarded_address is set, this will be the address of the client instead of the proxy.
• port (UInt16) — The client port that was used to make the query. When connected through a proxy and auth_use_forwarded_address is set, this will be the port of the client instead of the proxy.
• initial_user (String) — Name of the user who ran the initial query (for distributed query execution).
• initial_query_id (String) — ID of the initial query (for distributed query execution).
• initial_address (IPv6) — IP address that the parent query was launched from.
• initial_port (UInt16) — The client port that was used to make the parent query.
• initial_query_start_time (DateTime) — Initial query starting time (for distributed query execution).
• initial_query_start_time_microseconds (DateTime64(6)) — Initial query starting time with microseconds precision (for distributed query execution).
• authenticated_user (String) — Name of the user who was authenticated in the session.
• interface (UInt8) — Interface that the query was initiated from. Possible values: 1 — TCP, 2 — HTTP.
• is_secure (UInt8) — The flag whether a query was executed over a secure interface
• os_user (String) — Operating system username who runs clickhouse-client.
• client_hostname (String) — Hostname of the client machine where the clickhouse-client or another TCP client is run.
• client_name (String) — The clickhouse-client or another TCP client name.
• client_agent (String) — The AI coding agent that invoked the client (e.g. claude-code, cursor), detected from environment variables. Empty if no agent was detected.
• client_revision (UInt32) — Revision of the clickhouse-client or another TCP client.
• client_version_major (UInt32) — Major version of the clickhouse-client or another TCP client.
• client_version_minor (UInt32) — Minor version of the clickhouse-client or another TCP client.
• client_version_patch (UInt32) — Patch component of the clickhouse-client or another TCP client version.
• script_query_number (UInt32) — The query number in a script with multiple queries for clickhouse-client.
• script_line_number (UInt32) — The line number of the query start in a script with multiple queries for clickhouse-client.
• http_method (UInt8) — HTTP method that initiated the query. Possible values: 0 — The query was launched from the TCP interface, 1 — GET method was used, 2 — POST method was used.
• http_user_agent (String) — HTTP header UserAgent passed in the HTTP query.
• http_referer (String) — HTTP header Referer passed in the HTTP query (contains an absolute or partial address of the page making the query).
• forwarded_for (String) — HTTP header X-Forwarded-For passed in the HTTP query.
• quota_key (String) — The quota key specified in the quotas setting (see keyed).
• distributed_depth (UInt64) — How many times a query was forwarded between servers.
• revision (UInt32) — ClickHouse revision.
• log_comment (String) — Log comment. It can be set to arbitrary string no longer than max_query_size. An empty string if it is not defined.
• thread_ids (Array(UInt64)) — Thread ids that are participating in query execution. These threads may not have run simultaneously.
• peak_threads_usage (UInt64) — Maximum count of simultaneous threads executing the query.
• ProfileEvents (Map(String, UInt64)) — ProfileEvents that measure different metrics. The description of them could be found in the table system.events
• Settings (Map(String, String)) — Settings that were changed when the client ran the query. To enable logging changes to settings, set the log_query_settings parameter to 1.
• used_aggregate_functions (Array(String)) — Canonical names of aggregate functions, which were used during query execution.
• used_aggregate_function_combinators (Array(String)) — Canonical names of aggregate functions combinators, which were used during query execution.
• used_database_engines (Array(String)) — Canonical names of database engines, which were used during query execution.
• used_data_type_families (Array(String)) — Canonical names of data type families, which were used during query execution.
• used_dictionaries (Array(String)) — Canonical names of dictionaries, which were used during query execution.
• used_formats (Array(String)) — Canonical names of formats, which were used during query execution.
• used_functions (Array(String)) — Canonical names of functions, which were used during query execution.
• used_storages (Array(String)) — Canonical names of storages, which were used during query execution.
• used_table_functions (Array(String)) — Canonical names of table functions, which were used during query execution.
• used_executable_user_defined_functions (Array(String)) — Canonical names of executable user defined functions, which were used during query execution.
• used_sql_user_defined_functions (Array(String)) — Canonical names of sql user defined functions, which were used during query execution.
• used_row_policies (Array(String)) — The list of row policies names that were used during query execution.
• used_privileges (Array(String)) — Privileges which were successfully checked during query execution.
• missing_privileges (Array(String)) — Privileges that are missing during query execution.
• transaction_id (Tuple(UInt64, UInt64, UUID)) — The identifier of the transaction in scope of which this query was executed.
• query_cache_usage (Enum8(‘Unknown’ = 0, ‘None’ = 1, ‘Write’ = 2, ‘Read’ = 3)) — Usage of the query cache during query execution. Values: ‘Unknown’ = Status unknown, ‘None’ = The query result was neither written into nor read from the query result cache, ‘Write’ = The query result was written into the query result cache, ‘Read’ = The query result was read from the query result cache.
• asynchronous_read_counters (Map(String, UInt64)) — Metrics for asynchronous reading.
• is_internal (UInt8) — Indicates whether it is an auxiliary query executed internally.

• ProfileEvents.Names — Alias for mapKeys(ProfileEvents).
• ProfileEvents.Values — Alias for mapValues(ProfileEvents).
• Settings.Names — Alias for mapKeys(Settings).
• Settings.Values — Alias for mapValues(Settings).

​

Example

SELECT
    query_start_time,
    query_duration_ms,
    query
FROM system.user_query_log
ORDER BY query_start_time DESC
LIMIT 10;