A newer version of this documentation is available.

Audit File Details

Couchbase Server captures audit details in specified audit fields.

The table below contains some frequently used audit fields with corresponding descriptions. Note that different event-types generate different field-subsets.

Table 1. Audit record content
Field	Type	Description
`type`	string	The audit-type. For example, Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate.
`timestamp`	document	Contains the date and UTC time of the event in ISO 8601 format. For example, http://www.w3.org/TR/NOTE-datetime.
`id`	integer	A unique identifier for the event-type.
`local`	document `{ip: <String>, port: <int>},`	A JSON document that contains the local IP-address and the port-number of the running instance.
`remote`	document `{ip: <String>, port: <int>},`	A JSON document that contains the remote IP-address, the port-number, and additional information on the service used on the incoming connection associated with the event. Possible services include `cbmcd`, `cbhttp`, `cbmgmt`, `cbxdcr`, `cbn1ql`, and `cbsyncgw`.
`user`	string	A string that identifies the user.
`params`	document	Information dependent on the event-type. For example, for a bucket-operation, the bucket name is captured.
`result`	integer or string	An error-code or other message, related to the attempted operation.