Audit Event Reference
A complete list of the events audited by Couchbase Server.
Audit Events
The Couchbase Server auditing facility recognizes specific events, which can be selectively logged. The output is written to a log-file, which is periodically rotated.
An overview of event-auditing is provided in Auditing. An explanation of how to enable auditing and filtering certain events is provided in Manage Auditing.
The current page lists all events that can be audited.
Event Tables
The events listed in the following tables support the auditing of administrative and data changes, made on the cluster.
In each table, the first column (at the left) features the event-group heading (thereby repeating the table’s title, so as to ensure readability throughout the longer tables). The second column provides the event name. The third column provides the id for the event. The fourth column provides a description of the event; the fifth describes whether it is filterable; and the sixth indicates whether the event is classified as Data or Admin.
The tables — which are for the REST API, the Data Service, XDCR, the Query Service, the Search Service, the Eventing Service, the Analytics Service, and the Audit facility itself — are as follows.
REST API Events
The following events are generated by Couchbase Server in response to calls made with the REST API.
Event Group |
Event Name |
ID |
Description |
Filter? |
Event Type |
REST API |
login success |
8192 |
Successful login to cluster |
N |
Admin |
REST API |
login failure |
8193 |
Unsuccessful attempt to login to cluster |
N |
Admin |
REST API |
delete user |
8194 |
User was deleted |
N |
Admin |
REST API |
user credentials change |
8195 |
User credentials were changed |
N |
Admin |
REST API |
add node |
8196 |
Node was added to the cluster |
N |
Admin |
REST API |
remove node |
8197 |
Node was removed from the cluster |
N |
Admin |
REST API |
failover nodes |
8198 |
Nodes that were failed over |
N |
Admin |
REST API |
enter node recovery |
8199 |
Entered node recovery |
N |
Admin |
REST API |
rebalance initiated |
8200 |
Rebalance was initiated |
N |
Admin |
REST API |
create bucket |
8201 |
Bucket was created |
N |
Admin |
REST API |
modify bucket |
8202 |
Bucket was modified |
N |
Admin |
REST API |
delete bucket |
8203 |
Bucket was deleted |
N |
Admin |
REST API |
flush bucket |
8204 |
Bucket was flushed |
N |
Admin |
REST API |
start loading sample |
8205 |
Started loading sample |
N |
Admin |
REST API |
disk storage conf |
8206 |
Disk storage configuration was set |
N |
Admin |
REST API |
rename node |
8207 |
The node was renamed |
N |
Admin |
REST API |
setup node services |
8208 |
The services were set for the node |
N |
Admin |
REST API |
change cluster settings |
8209 |
Cluster settings were changed |
N |
Admin |
REST API |
add group |
8210 |
Server group was added |
N |
Admin |
REST API |
delete group |
8211 |
Server group was deleted |
N |
Admin |
REST API |
update group |
8212 |
Server group was updated |
N |
Admin |
REST API |
enable auto failover |
8220 |
Auto Failover was enabled |
N |
Admin |
REST API |
disable auto failover |
8221 |
Auto Failover was disabled |
N |
Admin |
REST API |
reset auto failover count |
8222 |
Count for Auto Failover was reset |
N |
Admin |
REST API |
enable cluster alerts |
8223 |
Cluster alerts were enabled |
N |
Admin |
REST API |
disable cluster alerts |
8224 |
Cluster alerts were disabled |
N |
Admin |
REST API |
modify compaction settings |
8225 |
Compaction settings were modified |
N |
Admin |
REST API |
regenerate certificate |
8226 |
Self-signed SSL certificate was regenerated |
N |
Admin |
REST API |
setup ldap |
8227 |
LDAP Auth settings were modified |
N |
Admin |
REST API |
internal settings |
8228 |
Internal Settings |
N |
Admin |
REST API |
upload cluster ca |
8229 |
Upload cluster CA |
N |
Admin |
REST API |
reload node certificate |
8230 |
Reload node certificate chain and pkey from inbox |
N |
Admin |
REST API |
modify index storage mode |
8231 |
Modify Index Storage Mode |
N |
Admin |
REST API |
set user |
8232 |
User was added or updated |
N |
Admin |
REST API |
master password change |
8233 |
Master password change was requested |
N |
Admin |
REST API |
encryption key rotation |
8234 |
Encryption key rotation was requested |
N |
Admin |
REST API |
password policy |
8235 |
Password policy was changed |
N |
Admin |
REST API |
client cert auth |
8236 |
Client certificate authentication settings changed |
N |
Admin |
REST API |
security settings |
8237 |
Security Settings |
N |
Admin |
REST API |
start log collection |
8238 |
Log collection run was started |
N |
Admin |
REST API |
modify log redaction settings |
8239 |
Log redaction settings were modified |
N |
Admin |
REST API |
configured audit daemon |
8240 |
loaded configuration file for audit daemon |
N |
Admin |
REST API |
modify index settings |
8241 |
Index service settings were modified |
N |
Admin |
REST API |
modify query settings |
8242 |
Query service settings were modified |
N |
Admin |
Data Service Events
The following events are generated by the Data Service, in response to attempts to access and modify data.
Event Group |
Event Name |
ID |
Description |
Filter? |
Event Type |
Data Service |
opened DCP connection |
20480 |
opened DCP connection |
N |
Admin |
Data Service |
authentication failed |
20481 |
authentication failed |
N |
Admin |
Data Service |
external memcached bucket flush |
20482 |
External user flushed the content of a memcached bucket |
N |
Admin |
Data Service |
invalid packet |
20483 |
Rejected an invalid packet |
N |
Admin |
Data Service |
command access failure |
20484 |
Rejected access to a command |
N |
Admin |
Data Service |
authentication succeeded |
20485 |
Authentication to the cluster succeeded |
N |
Admin |
Data Service |
privilege debug configured |
20486 |
The state of the privilege debug mode changed |
N |
Admin |
Data Service |
privilege debug |
20487 |
Access to a resource was granted due to privilege debug |
N |
Admin |
Data Service |
document read |
20488 |
Document was read |
Y |
Data |
Data Service |
document locked |
20489 |
Document was locked |
Y |
Data |
Data Service |
document modify |
20490 |
Document was modified |
Y |
Data |
Data Service |
document delete |
20491 |
Document was deleted |
Y |
Data |
XDCR Events
The following events are generated by XDCR.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
XDCR |
remote cluster ref creation |
16384 |
created remote cluster ref |
N |
Admin |
XDCR |
remote cluster ref update |
16385 |
updated remote cluster ref |
N |
Admin |
XDCR |
remote cluster ref deletion |
16386 |
deleted remote cluster ref |
N |
Admin |
XDCR |
replication creation |
16387 |
created replication |
N |
Admin |
XDCR |
replication pause |
16388 |
paused replication |
N |
Admin |
XDCR |
replication resume |
16389 |
resumed replication |
N |
Admin |
XDCR |
replication cancellation |
16390 |
canceled replication |
N |
Admin |
XDCR |
default replication settings update |
16391 |
updated default replication settings |
N |
Admin |
XDCR |
individual replication settings update |
16392 |
updated individual replication settings |
N |
Admin |
XDCR |
bucket settings update |
16393 |
updated bucket settings |
N |
Admin |
Query Service Events
The following events are generated by the Query Service, in response to statement-executions and API access-attempts.
Event Group |
Event Name |
ID |
Description |
Filter? |
Event Type |
Query Service |
SELECT statement |
28672 |
A N1QL SELECT statement was executed |
Y |
Data |
Query Service |
EXPLAIN statement |
28673 |
A N1QL EXPLAIN statement was executed |
Y |
Data |
Query Service |
PREPARE statement |
28674 |
A N1QL PREPARE statement was executed |
Y |
Data |
Query Service |
INFER statement |
28675 |
A N1QL INFER statement was executed |
Y |
Data |
Query Service |
INSERT statement |
28676 |
A N1QL INSERT statement was executed |
Y |
Data |
Query Service |
UPSERT statement |
28677 |
A N1QL UPSERT statement was executed |
Y |
Data |
Query Service |
DELETE statement |
28678 |
A N1QL DELETE statement was executed |
Y |
Data |
Query Service |
UPDATE statement |
28679 |
A N1QL UPDATE statement was executed |
Y |
Data |
Query Service |
MERGE statement |
28680 |
A N1QL MERGE statement was executed |
Y |
Data |
Query Service |
CREATE INDEX statement |
28681 |
A N1QL CREATE INDEX statement was executed |
Y |
Data |
Query Service |
DROP INDEX statement |
28682 |
A N1QL DROP INDEX statement was executed |
Y |
Data |
Query Service |
ALTER INDEX statement |
28683 |
A N1QL ALTER INDEX statement was executed |
Y |
Data |
Query Service |
BUILD INDEX statement |
28684 |
A N1QL BUILD INDEX statement was executed |
Y |
Data |
Query Service |
GRANT ROLE statement |
28685 |
A N1QL GRANT ROLE statement was executed |
Y |
Admin |
Query Service |
REVOKE ROLE statement |
28686 |
A N1QL REVOKE ROLE statement was executed |
Y |
Admin |
Query Service |
UNRECOGNIZED statement |
28687 |
An unrecognized statement was received by the N1QL query engine |
Y |
Admin |
Query Service |
CREATE PRIMARY INDEX statement |
28688 |
A N1QL CREATE PRIMARY INDEX statement was executed |
Y |
Data |
Query Service |
/admin/stats API request |
28689 |
An HTTP request was made to the API at /admin/stats |
Y |
Admin |
Query Service |
/admin/vitals API request |
28690 |
An HTTP request was made to the API at /admin/vitals |
Y |
Admin |
Query Service |
/admin/prepareds API request |
28691 |
An HTTP request was made to the API at /admin/prepareds |
Y |
Admin |
Query Service |
/admin/active_requests API request |
28692 |
An HTTP request was made to the API at /admin/active_requests |
Y |
Admin |
Query Service |
/admin/indexes/prepareds API request |
28693 |
An HTTP request was made to the API at /admin/indexes/prepareds |
Y |
Admin |
Query Service |
/admin/indexes/active_requests API request |
28694 |
An HTTP request was made to the API at /admin/indexes/active_requests |
Y |
Admin |
Query Service |
/admin/indexes/completed_requests API request |
28695 |
An HTTP request was made to the API at /admin/indexes/completed_requests |
Y |
Admin |
Query Service |
/admin/ping API request |
28697 |
An HTTP request was made to the API at /admin/ping |
Y |
Admin |
Query Service |
/admin/config API request |
28698 |
An HTTP request was made to the API at /admin/config |
Y |
Admin |
Query Service |
/admin/ssl_cert API request |
28699 |
An HTTP request was made to the API at /admin/ssl_cert |
Y |
Admin |
Query Service |
/admin/settings API request |
28700 |
An HTTP request was made to the API at /admin/settings |
Y |
Admin |
Query Service |
/admin/clusters API request |
28701 |
An HTTP request was made to the API at /admin/clusters |
Y |
Admin |
Query Service |
/admin/completed_requests API request |
28702 |
An HTTP request was made to the API at /admin/completed_requests |
Y |
Admin |
Query Service |
N1QL configuration |
28703 |
States that N1QL is using audit configuration with specified uuid |
N |
Admin |
Search Service Events
The following events are generated by the Search Service, in response to index and configuration changes, garbage collection, and resource profiling.
Event Group |
Event Name |
ID |
Description |
Filter? |
Event Type |
Search Service |
Delete index |
24576 |
FTS index was deleted |
N |
Data |
Search Service |
Create/Update index |
24577 |
FTS index was created/Updated |
N |
Data |
Search Service |
Control index |
24579 |
FTS index control command was issued |
N |
Data |
Search Service |
Config refresh |
24580 |
FTS config was refreshed |
N |
Admin |
Search Service |
Config replan |
24581 |
FTS config was replanned |
N |
Admin |
Search Service |
GC run |
24582 |
GC run was triggered |
N |
Admin |
Search Service |
CPU profile |
24583 |
CPU profiling was started |
N |
Admin |
Search Service |
Memory profile |
24584 |
Memory profiling was started |
N |
Admin |
Eventing Service Events
The following events are generated by the Eventing Service, in response to the definition, deployment, and execution of functions; debugging activities; configuration changes; and the importing and exporting of functions.
Event Group |
Event Name |
ID |
Description |
Filter? |
Event Type |
Eventing Service |
Create Function |
32768 |
Eventing function definition was created or updated |
Y |
Admin |
Eventing Service |
Delete Function |
32769 |
Eventing function definition was deleted |
Y |
Admin |
Eventing Service |
Fetch Functions |
32770 |
Eventing function definition was read |
Y |
Admin |
Eventing Service |
List Deployed |
32771 |
Eventing deployed functions list was read |
Y |
Admin |
Eventing Service |
Fetch Drafts |
32772 |
Eventing function draft definitions were read |
Y |
Admin |
Eventing Service |
Delete Drafts |
32773 |
Eventing function draft definitions were deleted |
Y |
Admin |
Eventing Service |
Save Draft |
32774 |
Save a draft definition to the store |
Y |
Admin |
Eventing Service |
Start Debug |
32775 |
Start eventing function debugger |
Y |
Admin |
Eventing Service |
Stop Debug |
32776 |
Stop eventing function debugger |
Y |
Admin |
Eventing Service |
Start Tracing |
32777 |
Start tracing eventing function execution |
Y |
Admin |
Eventing Service |
Stop Tracing |
32778 |
Stop tracing eventing function execution |
Y |
Admin |
Eventing Service |
Set Settings |
32779 |
Save settings for a given app |
Y |
Admin |
Eventing Service |
Fetch Config |
32780 |
Get config for eventing |
Y |
Admin |
Eventing Service |
Save Config |
32781 |
Save config for eventing |
Y |
Admin |
Eventing Service |
Cleanup Eventing |
32782 |
Clears up app definitions and settings from metakv |
Y |
Admin |
Eventing Service |
Get Settings |
32783 |
Get settings for a given app |
Y |
Admin |
Eventing Service |
Import Functions |
32784 |
Import a list of functions |
Y |
Admin |
Eventing Service |
Export Functions |
32785 |
Export the list of functions |
Y |
Admin |
Eventing Service |
List Running |
32786 |
Eventing running function list was read |
Y |
Admin |
Analytics Service Events
The following events are generated by the Analytics Service, in response to configuration changes.
Event Group |
Event Name |
ID |
Description |
Filter? |
Event Type |
Analytics Service |
Service configuration change |
36865 |
A successful service configuration change was made |
Y |
Admin |
Analytics Service |
Node configuration change |
36866 |
A successful node configuration change was made |
Y |
Admin |
Audit Events
The following events are generated by the audit daemon itself.
Event Group |
Event Name |
ID |
Description |
Filter? |
Event Type |
Audit |
configured audit daemon |
4096 |
Loaded configuration file for audit daemon |
N |
Admin |
Audit |
shutting down audit daemon |
4097 |
The audit daemon is being shut down |
N |
Admin |