A newer version of this documentation is available.

View Latest

Audit File Details

Couchbase Server captures audit details in specified audit fields.

The table below contains some frequently used audit fields with corresponding descriptions. Note that different event-types generate different field-subsets.

Table 1. Audit record content
Field Type Description

type

string

The audit-type. For example, Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate.

timestamp

document

Contains the date and UTC time of the event in ISO 8601 format. For example, http://www.w3.org/TR/NOTE-datetime.

id

integer

A unique identifier for the event-type.

local

document

{ip: <String>,
port: <int>},

A JSON document that contains the local IP-address and the port-number of the running instance.

remote

document

{ip: <String>,
port: <int>},

A JSON document that contains the remote IP-address, the port-number, and additional information on the service used on the incoming connection associated with the event.

Possible services include cbmcd, cbhttp, cbmgmt, cbxdcr, cbn1ql, and cbsyncgw.

user

string

A string that identifies the user.

params

document

Information dependent on the event-type. For example, for a bucket-operation, the bucket name is captured.

result

integer or string

An error-code or other message, related to the attempted operation.