Problem

When you query the audit logs or system table system.compute.clusters, you see a delete time for a given cluster, indicating it was deleted. When you follow up by checking the audit log events for the cluster ID, however, you don’t see a corresponding record matching the deleted cluster event.

Cause

When a cluster is inactive for a certain period (typically 30 days), it is automatically deleted to free up resources. Databricks does not audit clusters that are deleted due to inactivity in the audit logs, so no corresponding event appears.

Solution

Pin your cluster to avoid automatic deletion due to inactivity. You can use either the Databricks API or the workspace UI to do so. For details, refer to the Manage compute (AWS | Azure | GCP) documentation.

If you don’t want to pin your cluster, monitor cluster usage to ensure it isn’t left idle for extended periods. This can help prevent automatic deletion due to inactivity.