A newer version of this documentation is available.

View Latest

Audit File Details

Couchbase Server captures audit details in specified audit fields.

The table shows audit details with their descriptions.

Table 1. Audit record content
Field Type Description

type

string

This is the type of the audit. For example: Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate, and so on.

timestamp

document

Contains the date and UTC time of the event in the ISO 8601 format. For example, http://www.w3.org/TR/NOTE-datetime

local

document

{ip: <String>,
port: <int>},

A JSON document that contains the local IP address and the port number of the running instance.

remote

document

{ip: <String>,
port: <int>},

A JSON document that contains the remote IP address and the port number in addition to the information about the service that was used on the incoming connection associated with the event.

Possible services include: cbmcd, cbhttp, cbmgmt, cbxdcr, cbn1ql, cbsyncgw.

userid

string

A string that identifies the userID.

params

document

Depends on the event type. For example, for a bucket operation, it will capture the bucket name.

result

integer or string

This is the error code or a message of the operation that was tried.

The audit capture for different administrator events may have different fields depending on the event type. However, every audit event will register who does what, when, and how.