Skip to main content

AUDIT.CATALOG.UNREAD — the catalog could not be read, so nothing was judged

  • Category: safety
  • Level: 0
  • Stability: stable
  • Suites: audit

The audit suite reads a live database's catalog and judges what it finds. When that read does not happen — no privilege, an unreachable server, a budget exhausted mid-read — there is nothing to judge, and an empty finding list is what a perfectly healthy database also produces.

This notice is the difference between those two reports.

The reason travels​

The finding carries a named reason rather than a generic failure, because the remedies are unrelated:

  • missing_privilege — the role cannot read the catalog views it needs. Grant, or accept a narrower audit.
  • managed_database_restriction — a hosted database withholds something no grant can restore. This is the one that is not fixable, and saying so is more useful than suggesting a grant that will not work.
  • catalog_read_budget_exceeded — the read hit its time budget. Raise sqlens.catalog.budget_ms, or narrow the schema scope.
  • server_unreachable — nothing answered.

Partial reads are reported as partial​

A catalog read that got some of the way through is not thrown away. What was read is judged; what was not is reported as a skip with its own reason, per area. So an audit against a restricted managed database still produces real findings about the tables it could see, and states plainly which parts of the picture are missing.

That is the whole design: degrade in a way the reader can see, never in a way that looks like success.

What SQLens needs to read​

Read access to the catalog views, and nothing else. The reader session is sealed read-only and proves the seal before it reads anything — it writes nothing, takes no lock, and creates nothing. If an audit ever appears to need a write privilege, that is a bug rather than a requirement.