---
title: System datasets
description: Every dataset in the Coralogix-managed system dataspace, with what it records and a link to its schema.
url: https://coralogix.com/docs/user-guides/data-layer/system_dataspace/system-datasets/
product: dataengine
feature: Dataset Management
feature_id: dataspace-dataset-mgmt
feature_identifier: dataengine/dataspace-dataset-mgmt
last_updated: '2026-10-12'
---

# System datasets

System datasets live in the [`system` dataspace](https://coralogix.com/docs/user-guides/data-layer/system_dataspace.md). Coralogix creates and maintains them, and they record activity inside your Coralogix account, such as alert history, audit events, and quota consumption. They are read-only: you query them, but you can't write to them.

Enable a system dataset before you query it. In **Data Flow**, open **Dataset Management**, select the **System** tab, and turn on write access for the dataset.

| Dataset                                                                                                                    | Description                                                                                                                    |
| -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| [`aaa.audit_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/aaa_audit-events.md)               | Audit trail of system activity for compliance and access monitoring.                                                           |
| [`alerts.history`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/alerts-history.md)                   | History of alert evaluations and trigger events.                                                                               |
| [`engine.queries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine_queries.md)                   | Historical record of user queries for introspection and optimization.                                                          |
| [`engine.schema_fields`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine-schema_fields.md)       | Tracks field-level schema evolution over time.                                                                                 |
| [`labs.limitViolations`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/labs_limit-violations.md)      | Records each time a configured limit is exceeded.                                                                              |
| [`notification.deliveries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/notification_deliveries.md) | Logs Notification Center delivery events. Alerts record delivery failures; Cases record both successful and failed deliveries. |
| [`dataplan.quota_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/quota_events.md)              | Stream of quota-related events, allocations, consumption, and threshold breaches.                                              |
| [`dataplan.usage_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/dataplan-usage-events.md)     | Aggregated team data usage events, after unit ratios are applied.                                                              |

Each dataset page describes the dataset and lists its fields. Every system dataset carries the same record envelope: engine metadata in `$m`, labels in `$l`, and the dataset-specific payload in `$d`. See [Entity types](https://coralogix.com/docs/user-guides/data-layer/entity-types.md) for how the envelope works.

## Query a system dataset

Reference a system dataset by its dataspace and name:

```
source system/engine.queries
```

All system datasets support full DataPrime functionality. You can filter, aggregate, group, and visualize them in Explore queries, Custom Dashboards, and automated reports. Their events count toward your daily quota, but volumes are typically small compared to your own data.

## Next steps

* Learn how the `system` dataspace fits alongside your own data in [The `system` dataspace](https://coralogix.com/docs/user-guides/data-layer/system_dataspace.md).
* Manage access to system datasets in [Dataset management](https://coralogix.com/docs/user-guides/data-layer/dataset-management.md).