Audit File Details

Couchbase Server captures audit details in specified audit fields.

The table below contains some frequently used audit fields with corresponding descriptions. Note that different event-types generate different field-subsets.

Table 1. Audit record content
Field Type Description

type

string

The audit-type. For example, Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate.

timestamp

document

Contains the date and UTC time of the event in ISO 8601 format. For example, http://www.w3.org/TR/NOTE-datetime.

id

integer

A unique identifier for the event-type.

local

document

{ip: <String>,
port: <int>},

A JSON document that contains the local IP-address and the port-number of the running instance.

remote

document

{ip: <String>,
port: <int>},

A JSON document that contains the remote IP-address, the port-number, and additional information on the service used on the incoming connection associated with the event.

Possible services include cbmcd, cbhttp, cbmgmt, cbxdcr, cbn1ql, and cbsyncgw.

user

string

A string that identifies the user.

params

document

Information dependent on the event-type. For example, for a bucket-operation, the bucket name is captured.

result

integer or string

An error-code or other message, related to the attempted operation.