Audit Event Reference

A complete list of the events audited by Couchbase Server.

Audit Events

The Couchbase Server auditing facility recognizes specific events, which can be selectively logged. The output is written to a log-file, which is periodically rotated.

An overview of event-auditing is provided in Auditing. An explanation of how to enable the auditing and filtering of certain events is provided in Manage Auditing.

The current page lists all events that can be audited.

Event Tables

The events listed in the following tables support the auditing of administrative and data changes, made on the cluster.

In each table, the first column (at the left) features the event-group heading (thereby repeating the table’s title, so as to ensure readability throughout the longer tables). The second column provides the event name. The third column provides the id for the event. The fourth column provides a description of the event; the fifth describes whether it is filterable; and the sixth indicates whether the event is classified as Data or Admin.

The tables — which are for the REST API, the Data Service, the Query Service, the Search Service, the Eventing Service, the Analytics Service, the View Engine, and the Audit facility itself — are as follows.

REST API Events

The following events are generated by Couchbase Server in response to calls made with the REST API.

Event Group

Event Name

ID

Description

Filter?

Event Type

REST API

login success

8192

Successful login to cluster

N

Admin

REST API

login failure

8193

Unsuccessful attempt to login to cluster

N

Admin

REST API

delete user

8194

User was deleted

N

Admin

REST API

user credentials change

8195

User credentials were changed

N

Admin

REST API

add node

8196

Node was added to the cluster

N

Admin

REST API

remove node

8197

Node was removed from the cluster

N

Admin

REST API

failover nodes

8198

Nodes that were failed over

N

Admin

REST API

enter node recovery

8199

Entered node recovery

N

Admin

REST API

rebalance initiated

8200

Rebalance was initiated

N

Admin

REST API

create bucket

8201

Bucket was created

N

Admin

REST API

modify bucket

8202

Bucket was modified

N

Admin

REST API

delete bucket

8203

Bucket was deleted

N

Admin

REST API

flush bucket

8204

Bucket was flushed

N

Admin

REST API

start loading sample

8205

Started loading sample

N

Admin

REST API

disk storage conf

8206

Disk storage configuration was set

N

Admin

REST API

rename node

8207

The node was renamed

N

Admin

REST API

setup node services

8208

The services were set for the node

N

Admin

REST API

change cluster settings

8209

Cluster settings were changed

N

Admin

REST API

add group

8210

Server group was added

N

Admin

REST API

delete group

8211

Server group was deleted

N

Admin

REST API

update group

8212

Server group was updated

N

Admin

REST API

xdcr create cluster ref

8213

Remote cluster reference was created

N

Admin

REST API

xdcr update cluster ref

8214

Remote cluster reference was updated

N

Admin

REST API

xdcr delete cluster ref

8215

Remote cluster reference was deleted

N

Admin

REST API

xdcr create replication

8216

XDCR replication was created

N

Admin

REST API

xdcr update replication

8217

XDCR replication was updated

N

Admin

REST API

xdcr cancel replication

8218

XDCR replication was canceled

N

Admin

REST API

xdcr update global settings

8219

Global XDCR settings were updated

N

Admin

REST API

enable auto failover

8220

Auto Failover was enabled

N

Admin

REST API

disable auto failover

8221

Auto Failover was disabled

N

Admin

REST API

reset auto failover count

8222

Count for Auto Failover was reset

N

Admin

REST API

enable cluster alerts

8223

Cluster alerts were enabled

N

Admin

REST API

disable cluster alerts

8224

Cluster alerts were disabled

N

Admin

REST API

modify compaction settings

8225

Compaction settings were modified

N

Admin

REST API

regenerate certificate

8226

Self-signed SSL certificate was regenerated

N

Admin

REST API

setup ldap

8227

LDAP Auth settings were modified

N

Admin

REST API

internal settings

8228

Internal Settings

N

Admin

REST API

upload cluster ca

8229

Upload cluster CA

N

Admin

REST API

reload node certificate

8230

Reload node certificate chain and pkey from inbox

N

Admin

REST API

modify index storage mode

8231

Modify Index Storage Mode

N

Admin

REST API

set user

8232

User was added or updated

N

Admin

REST API

master password change

8233

Master password change was requested

N

Admin

REST API

encryption key rotation

8234

Encryption key rotation was requested

N

Admin

REST API

password policy

8235

Password policy was changed

N

Admin

REST API

client cert auth

8236

Client certificate authentication settings changed

N

Admin

REST API

security settings

8237

Security Settings

N

Admin

REST API

start log collection

8238

Log collection run was started

N

Admin

REST API

modify log redaction settings

8239

Log redaction settings were modified

N

Admin

REST API

configured audit daemon

8240

loaded configuration file for audit daemon

N

Admin

REST API

modify index settings

8241

Index service settings were modified

N

Admin

REST API

modify query settings

8242

Query service settings were modified

N

Admin

REST API

mutate document

8243

Document was mutated via the REST API

Y

Data

REST API

set user group

8244

User group was added or updated

N

Admin

REST API

delete user group

8245

User group was deleted

N

Admin

REST API

modify ldap settings

8246

Ldap settings were modified

N

Admin

REST API

developer preview settings

8247

Developer preview settings

N

Admin

REST API

license settings

8248

License settings

N

Admin

REST API

set user profile

8249

UI profile was added or updated

N

Admin

REST API

deleted user profile

8250

UI profile was deleted

N

Admin

REST API

modify retry rebalance

8251

Retry rebalance settings were modified

N

Admin

REST API

enable auto reprovision

8252

Auto reprovision was enabled

N

Admin

REST API

disable auto reprovision

8253

Auto reprovision was disabled

N

Admin

REST API

failover settings

8254

Failover settings

N

Admin

REST API

read document

8255

Document was read via the REST API

Y

Data

REST API

logout success

8256

Successful logout of couchbase cluster

N

Admin

REST API

alert email sent

8257

An alert email was successfully sent

Y

Admin

Data Service Events

The following events are generated by the Data Service, in response to attempts to access and modify data.

Event Group

Event Name

ID

Description

Filter?

Event Type

Data Service

opened DCP connection

20480

opened DCP connection

N

Admin

Data Service

authentication failed

20481

authentication failed

N

Admin

Data Service

external memcached bucket flush

20482

External user flushed the content of a memcached bucket

N

Admin

Data Service

invalid packet

20483

Rejected an invalid packet

N

Admin

Data Service

command access failure

20484

Rejected access to a command

N

Admin

Data Service

authentication succeeded

20485

Authentication to the cluster succeeded

N

Admin

Data Service

privilege debug configured

20486

The state of the privilege debug mode changed

N

Admin

Data Service

privilege debug

20487

Access to a resource was granted due to privilege debug

N

Admin

Data Service

document read

20488

Document was read

Y

Data

Data Service

document locked

20489

Document was locked

Y

Data

Data Service

document modify

20490

Document was modified

Y

Data

Data Service

document delete

20491

Document was deleted

Y

Data

Data Service

select bucket

20492

The specified bucket was selected

Y

Admin

Query and Index Service Events

The following events are generated by the Query and Index Services, in response to statement-executions and API access-attempts.

Event Group

Event Name

ID

Description

Filter?

Event Type

Query and Index Services

SELECT statement

28672

A N1QL SELECT statement was executed

Y

Data

Query and Index Services

EXPLAIN statement

28673

A N1QL EXPLAIN statement was executed

Y

Data

Query and Index Services

PREPARE statement

28674

A N1QL PREPARE statement was executed

Y

Data

Query and Index Services

INFER statement

28675

A N1QL INFER statement was executed

Y

Data

Query and Index Services

INSERT statement

28676

A N1QL INSERT statement was executed

Y

Data

Query and Index Services

UPSERT statement

28677

A N1QL UPSERT statement was executed

Y

Data

Query and Index Services

DELETE statement

28678

A N1QL DELETE statement was executed

Y

Data

Query and Index Services

UPDATE statement

28679

A N1QL UPDATE statement was executed

Y

Data

Query and Index Services

MERGE statement

28680

A N1QL MERGE statement was executed

Y

Data

Query and Index Services

CREATE INDEX statement

28681

A N1QL CREATE INDEX statement was executed

Y

Data

Query and Index Services

DROP INDEX statement

28682

A N1QL DROP INDEX statement was executed

Y

Data

Query and Index Services

ALTER INDEX statement

28683

A N1QL ALTER INDEX statement was executed

Y

Data

Query and Index Services

BUILD INDEX statement

28684

A N1QL BUILD INDEX statement was executed

Y

Data

Query and Index Services

GRANT ROLE statement

28685

A N1QL GRANT ROLE statement was executed

Y

Admin

Query and Index Services

REVOKE ROLE statement

28686

A N1QL REVOKE ROLE statement was executed

Y

Admin

Query and Index Services

UNRECOGNIZED statement

28687

An unrecognized statement was received by the N1QL query engine

Y

Admin

Query and Index Services

CREATE PRIMARY INDEX statement

28688

A N1QL CREATE PRIMARY INDEX statement was executed

Y

Data

Query and Index Services

/admin/stats API request

28689

An HTTP request was made to the API at /admin/stats

Y

Admin

Query and Index Services

/admin/vitals API request

28690

An HTTP request was made to the API at /admin/vitals

Y

Admin

Query and Index Services

/admin/prepareds API request

28691

An HTTP request was made to the API at /admin/prepareds

Y

Admin

Query and Index Services

/admin/active_requests API request

28692

An HTTP request was made to the API at /admin/active_requests

Y

Admin

Query and Index Services

/admin/indexes/prepareds API request

28693

An HTTP request was made to the API at /admin/indexes/prepareds

Y

Admin

Query and Index Services

/admin/indexes/active_requests API request

28694

An HTTP request was made to the API at /admin/indexes/active_requests

Y

Admin

Query and Index Services

/admin/indexes/completed_requests API request

28695

An HTTP request was made to the API at /admin/indexes/completed_requests

Y

Admin

Query and Index Services

/admin/ping API request

28697

An HTTP request was made to the API at /admin/ping

Y

Admin

Query and Index Services

/admin/config API request

28698

An HTTP request was made to the API at /admin/config

Y

Admin

Query and Index Services

/admin/ssl_cert API request

28699

An HTTP request was made to the API at /admin/ssl_cert

Y

Admin

Query and Index Services

/admin/settings API request

28700

An HTTP request was made to the API at /admin/settings

Y

Admin

Query and Index Services

/admin/clusters API request

28701

An HTTP request was made to the API at /admin/clusters

Y

Admin

Query and Index Services

/admin/completed_requests API request

28702

An HTTP request was made to the API at /admin/completed_requests

Y

Admin

Query and Index Services

N1QL configuration

28703

States that N1QL is using audit configuration with specified uuid

N

Admin

Query and Index Services

/admin/functions API request

28704

An HTTP request was made to the API at /admin/functions.

Y

Admin

Query and Index Services

/admin/indexes/functions API request

28705

An HTTP request was made to the API at /admin/indexes/functions.

Y

Admin

Search Service Events

The following events are generated by the Search Service, in response to index and configuration changes, garbage collection, and resource profiling.

Event Group

Event Name

ID

Description

Filter?

Event Type

Search Service

Delete index

24576

FTS index was deleted

N

Data

Search Service

Create/Update index

24577

FTS index was created/Updated

N

Data

Search Service

Control index

24579

FTS index control command was issued

N

Data

Search Service

Config refresh

24580

FTS config was refreshed

N

Admin

Search Service

Config replan

24581

FTS config was replanned

N

Admin

Search Service

GC run

24582

GC run was triggered

N

Admin

Search Service

CPU profile

24583

CPU profiling was started

N

Admin

Search Service

Memory profile

24584

Memory profiling was started

N

Admin

Eventing Service Events

The following events are generated by the Eventing Service, in response to the definition, deployment, and execution of functions; debugging activities; configuration changes; and the importing and exporting of functions.

Event Group

Event Name

ID

Description

Filter?

Event Type

Eventing Service

Create Function

32768

Eventing function definition was created or updated

Y

Admin

Eventing Service

Delete Function

32769

Eventing function definition was deleted

Y

Admin

Eventing Service

Fetch Functions

32770

Eventing function definition was read

Y

Admin

Eventing Service

List Deployed

32771

Eventing deployed functions list was read

Y

Admin

Eventing Service

Fetch Drafts

32772

Eventing function draft definitions were read

Y

Admin

Eventing Service

Delete Drafts

32773

Eventing function draft definitions were deleted

Y

Admin

Eventing Service

Save Draft

32774

Save a draft definition to the store

Y

Admin

Eventing Service

Start Debug

32775

Start eventing function debugger

Y

Admin

Eventing Service

Stop Debug

32776

Stop eventing function debugger

Y

Admin

Eventing Service

Start Tracing

32777

Start tracing eventing function execution

Y

Admin

Eventing Service

Stop Tracing

32778

Stop tracing eventing function execution

Y

Admin

Eventing Service

Set Settings

32779

Save settings for a given app

Y

Admin

Eventing Service

Fetch Config

32780

Get config for eventing

Y

Admin

Eventing Service

Save Config

32781

Save config for eventing

Y

Admin

Eventing Service

Cleanup Eventing

32782

Clears up app definitions and settings from metakv

Y

Admin

Eventing Service

Get Settings

32783

Get settings for a given app

Y

Admin

Eventing Service

Import Functions

32784

Import a list of functions

Y

Admin

Eventing Service

Export Functions

32785

Export the list of functions

Y

Admin

Eventing Service

List Running

32786

Eventing running function list was read

Y

Admin

Analytics Service Events

The following events are generated by the Analytics Service, in response to configuration changes.

Event Group

Event Name

ID

Description

Filter?

Event Type

Analytics Service

Service configuration change

36865

A successful service configuration change was made

Y

Admin

Analytics Service

Node configuration change

36866

A successful node configuration change was made

Y

Admin

View Engine Events

The following events are generated by the View Engine.

Event Group

Event Name

ID

Description

Filter?

Event Type

View Engine

Create Design Doc

40960

Design Doc is Created

Y

Data

View Engine

Delete Design Doc

40961

Design Doc is Deleted

Y

Data

View Engine

Query DDoc Meta Data

40962

Design Doc Meta Data Query Request

Y

Data

View Engine

View Query

40963

View Query Request

Y

Data

View Engine

Update Design Doc

40964

Design Doc is Updated

Y

Data

View Engine

Audit Configuration change

40965

Change in Audit Configuration

N

Admin

Audit Events

The following events are generated by the audit daemon itself.

Event Group

Event Name

ID

Description

Filter?

Event Type

Audit

configured audit daemon

4096

Loaded configuration file for audit daemon

N

Admin

Audit

shutting down audit daemon

4097

The audit daemon is being shut down

N

Admin