A newer version of this documentation is available.

View Latest

Audit File Details

    +
    Couchbase Server captures audit details in specified audit fields.

    The table below contains some frequently used audit fields with corresponding descriptions. Note that different event-types generate different field-subsets.

    Table 1. Audit record content
    Field Type Description

    type

    string

    The audit-type. For example, Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate.

    timestamp

    document

    Contains the date and UTC time of the event in ISO 8601 format. For example, http://www.w3.org/TR/NOTE-datetime.

    id

    integer

    A unique identifier for the event-type.

    local

    document

    {ip: <String>,
    port: <int>},

    A JSON document that contains the local IP-address and the port-number of the running instance.

    remote

    document

    {ip: <String>,
    port: <int>},

    A JSON document that contains the remote IP-address, the port-number, and additional information on the service used on the incoming connection associated with the event.

    Possible services include cbmcd, cbhttp, cbmgmt, cbxdcr, cbn1ql, and cbsyncgw.

    user

    string

    A string that identifies the user.

    params

    document

    Information dependent on the event-type. For example, for a bucket-operation, the bucket name is captured.

    result

    integer or string

    An error-code or other message, related to the attempted operation.