Audit Event Reference
A complete list of the events audited by Enterprise Analytics.
Audit Events
The Enterprise Analytics auditing facility recognizes specific events, which can be selectively logged. The output is written to a log-file, which is periodically rotated.
An overview of event-auditing is provided in Auditing. An explanation of how to enable the auditing and filtering of certain events is provided in Manage Auditing.
The current page lists all events that can be audited.
Event Tables
The events listed in the following tables support the auditing of administrative and data changes, made on the cluster.
In each table, the first column (at the left) features the event-group heading (thereby repeating the table’s title, so as to ensure readability throughout the longer tables). The second column provides the event name. The third column provides the id for the event. The fourth column provides a description of the event; the fifth describes whether it is filterable; and the sixth indicates whether the event is classified as Data or Admin.
The tables — which are for the REST API and the Analytics Service are as follows.
REST API Events
The following events are generated by Enterprise Analytics in response to calls made with the REST API.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
REST API |
login success |
8192 |
Successful login to cluster |
N |
Admin |
REST API |
login failure |
8193 |
Unsuccessful attempt to login to cluster |
N |
Admin |
REST API |
delete user |
8194 |
User was deleted |
N |
Admin |
REST API |
user credentials change |
8195 |
User credentials were changed |
N |
Admin |
REST API |
add node |
8196 |
Node was added to the cluster |
N |
Admin |
REST API |
remove node |
8197 |
Node was removed from the cluster |
N |
Admin |
REST API |
failover nodes |
8198 |
Nodes that were failed over |
N |
Admin |
REST API |
enter node recovery |
8199 |
Entered node recovery |
N |
Admin |
REST API |
rebalance initiated |
8200 |
Rebalance was initiated |
N |
Admin |
REST API |
create bucket |
8201 |
Bucket was created |
N |
Admin |
REST API |
modify bucket |
8202 |
Bucket was modified |
N |
Admin |
REST API |
delete bucket |
8203 |
Bucket was deleted |
N |
Admin |
REST API |
flush bucket |
8204 |
Bucket was flushed |
N |
Admin |
REST API |
start loading sample |
8205 |
Started loading sample |
N |
Admin |
REST API |
disk storage conf |
8206 |
Disk storage configuration was set |
N |
Admin |
REST API |
rename node |
8207 |
The node was renamed |
N |
Admin |
REST API |
setup node services |
8208 |
The services were set for the node |
N |
Admin |
REST API |
change cluster settings |
8209 |
Cluster settings were changed |
N |
Admin |
REST API |
add group |
8210 |
Server group was added |
N |
Admin |
REST API |
delete group |
8211 |
Server group was deleted |
N |
Admin |
REST API |
update group |
8212 |
Server group was updated |
N |
Admin |
REST API |
enable auto failover |
8220 |
Auto Failover was enabled |
N |
Admin |
REST API |
disable auto failover |
8221 |
Auto Failover was disabled |
N |
Admin |
REST API |
reset auto failover count |
8222 |
Count for Auto Failover was reset |
N |
Admin |
REST API |
enable cluster alerts |
8223 |
Cluster alerts were enabled |
N |
Admin |
REST API |
disable cluster alerts |
8224 |
Cluster alerts were disabled |
N |
Admin |
REST API |
modify compaction settings |
8225 |
Compaction settings were modified |
N |
Admin |
REST API |
regenerate certificate |
8226 |
Self-signed SSL certificate was regenerated |
N |
Admin |
REST API |
setup ldap |
8227 |
LDAP Auth settings were modified |
N |
Admin |
REST API |
internal settings |
8228 |
Internal Settings |
N |
Admin |
REST API |
upload cluster ca |
8229 |
Upload cluster CA |
N |
Admin |
REST API |
reload node certificate |
8230 |
Reload node certificate chain and pkey from inbox |
N |
Admin |
REST API |
modify index storage mode |
8231 |
Modify Index Storage Mode |
N |
Admin |
REST API |
set user |
8232 |
User was added or updated |
N |
Admin |
REST API |
master password change |
8233 |
Master password change was requested |
N |
Admin |
REST API |
encryption key rotation |
8234 |
Encryption key rotation was requested |
N |
Admin |
REST API |
password policy |
8235 |
Password policy was changed |
N |
Admin |
REST API |
client cert auth |
8236 |
Client certificate authentication settings changed |
N |
Admin |
REST API |
security settings |
8237 |
Security Settings |
N |
Admin |
REST API |
start log collection |
8238 |
Log collection run was started |
N |
Admin |
REST API |
modify log redaction settings |
8239 |
Log redaction settings were modified |
N |
Admin |
REST API |
configured audit daemon |
8240 |
loaded configuration file for audit daemon |
N |
Admin |
REST API |
modify index settings |
8241 |
Index service settings were modified |
N |
Admin |
REST API |
modify query settings |
8242 |
Query service settings were modified |
N |
Admin |
REST API |
mutate document |
8243 |
Document was mutated via the REST API |
Y |
Data |
REST API |
set user group |
8244 |
User group was added or updated |
N |
Admin |
REST API |
delete user group |
8245 |
User group was deleted |
N |
Admin |
REST API |
modify ldap settings |
8246 |
Ldap settings were modified |
N |
Admin |
REST API |
developer preview settings |
8247 |
Developer preview settings |
N |
Admin |
REST API |
license settings |
8248 |
License settings |
N |
Admin |
REST API |
set user profile |
8249 |
UI profile was added or updated |
N |
Admin |
REST API |
deleted user profile |
8250 |
UI profile was deleted |
N |
Admin |
REST API |
modify retry rebalance |
8251 |
Retry rebalance settings were modified |
N |
Admin |
REST API |
enable auto reprovision |
8252 |
Auto reprovision was enabled |
N |
Admin |
REST API |
disable auto reprovision |
8253 |
Auto reprovision was disabled |
N |
Admin |
REST API |
failover settings |
8254 |
Failover settings |
N |
Admin |
REST API |
read document |
8255 |
Document was read via the REST API |
Y |
Data |
REST API |
logout success |
8256 |
Successful logout of couchbase cluster |
N |
Admin |
REST API |
alert email sent |
8257 |
An alert email was successfully sent |
Y |
Admin |
REST API |
session timeout |
8258 |
User session has ended due to a timeout |
N |
Admin |
REST API |
create scope |
8259 |
Scope was created |
N |
Data |
REST API |
drop scope |
8260 |
Scope was dropped |
N |
Data |
REST API |
create collection |
8261 |
Collection was created |
N |
Data |
REST API |
drop collection |
8262 |
Collection was dropped |
N |
Data |
REST API |
set manifest |
8263 |
Setting bucket manifest |
N |
Data |
REST API |
authentication failure |
8264 |
REST operation failed due to authentication failure |
N |
Admin |
REST API |
RBAC information retrieved |
8265 |
RBAC information was retrieved |
Y |
Admin |
REST API |
Admin password reset |
8266 |
Admin password was reset |
N |
Admin |
REST API |
modify analytics settings |
8267 |
Analytics service settings were modified |
N |
Admin |
REST API |
update scope |
8268 |
Scope properties were updated |
N |
Admin |
REST API |
delete cluster ca |
8269 |
Delete cluster CA |
N |
Admin |
REST API |
serverless settings |
8270 |
Serverless settings |
N |
Admin |
Analytics Service Events
The following events are generated by the Analytics Service, in response to configuration changes and statement executions.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Analytics Service |
Service configuration change |
36865 |
A successful service configuration change was made |
Y |
Admin |
Analytics Service |
Node configuration change |
36866 |
A successful node configuration change was made |
Y |
Admin |
Analytics Service |
SELECT statement |
36867 |
A N1QL SELECT statement was executed |
Y |
Data |
Analytics Service |
CREATE DATAVERSE statement |
36868 |
A N1QL CREATE DATAVERSE statement was executed |
Y |
Data |
Analytics Service |
DROP DATAVERSE statement |
36869 |
A N1QL DROP DATAVERSE statement was executed |
Y |
Data |
Analytics Service |
CREATE DATASET statement |
36870 |
A N1QL CREATE DATASET statement was executed |
Y |
Data |
Analytics Service |
DROP DATASET statement |
36871 |
A N1QL DROP DATASET statement was executed |
Y |
Data |
Analytics Service |
CREATE INDEX statement |
36872 |
A N1QL CREATE INDEX statement was executed |
Y |
Data |
Analytics Service |
DROP INDEX statement |
36873 |
A N1QL DROP INDEX statement was executed |
Y |
Data |
Analytics Service |
CONNECT LINK statement |
36877 |
A N1QL CONNECT LINK statement was executed |
Y |
Data |
Analytics Service |
DISCONNECT LINK statement |
36878 |
A N1QL DISCONNECT LINK statement was executed |
Y |
Data |
Analytics Service |
UNRECOGNIZED statement |
36879 |
An UNRECOGNIZED N1QL statement was encountered |
Y |
Admin |
Analytics Service |
ALTER COLLECTION statement |
36880 |
A N1QL ALTER COLLECTION statement was executed |
Y |
Data |