Audit Event Reference

    +
    A complete list of the events audited by Couchbase Server.

    Audit Events

    The Couchbase Server auditing facility recognizes specific events, which can be selectively logged. The output is written to a log-file, which is periodically rotated.

    An overview of event-auditing is provided in Auditing. An explanation of how to enable the auditing and filtering of certain events is provided in Manage Auditing.

    The current page lists all events that can be audited.

    Event Tables

    The events listed in the following tables support the auditing of administrative and data changes, made on the cluster.

    In each table, the first column (at the left) features the event-group heading (thereby repeating the table’s title, so as to ensure readability throughout the longer tables). The second column provides the event name. The third column provides the id for the event. The fourth column provides a description of the event; the fifth describes whether it is filterable; and the sixth indicates whether the event is classified as Data or Admin.

    The tables — which are for the REST API, the Data Service, the Query Service, the Search Service, the Eventing Service, the Analytics Service, the View Engine, and the Audit facility itself — are as follows.

    REST API Events

    The following events are generated by Couchbase Server in response to calls made with the REST API.

    Event Group Event Name ID Description Filter? Event Type

    REST API

    login success

    8192

    Successful login to cluster

    N

    Admin

    REST API

    login failure

    8193

    Unsuccessful attempt to login to cluster

    N

    Admin

    REST API

    delete user

    8194

    User was deleted

    N

    Admin

    REST API

    user credentials change

    8195

    User credentials were changed

    N

    Admin

    REST API

    add node

    8196

    Node was added to the cluster

    N

    Admin

    REST API

    remove node

    8197

    Node was removed from the cluster

    N

    Admin

    REST API

    failover nodes

    8198

    Nodes that were failed over

    N

    Admin

    REST API

    enter node recovery

    8199

    Entered node recovery

    N

    Admin

    REST API

    rebalance initiated

    8200

    Rebalance was initiated

    N

    Admin

    REST API

    create bucket

    8201

    Bucket was created

    N

    Admin

    REST API

    modify bucket

    8202

    Bucket was modified

    N

    Admin

    REST API

    delete bucket

    8203

    Bucket was deleted

    N

    Admin

    REST API

    flush bucket

    8204

    Bucket was flushed

    N

    Admin

    REST API

    start loading sample

    8205

    Started loading sample

    N

    Admin

    REST API

    disk storage conf

    8206

    Disk storage configuration was set

    N

    Admin

    REST API

    rename node

    8207

    The node was renamed

    N

    Admin

    REST API

    setup node services

    8208

    The services were set for the node

    N

    Admin

    REST API

    change cluster settings

    8209

    Cluster settings were changed

    N

    Admin

    REST API

    add group

    8210

    Server group was added

    N

    Admin

    REST API

    delete group

    8211

    Server group was deleted

    N

    Admin

    REST API

    update group

    8212

    Server group was updated

    N

    Admin

    REST API

    xdcr create cluster ref

    8213

    Remote cluster reference was created

    N

    Admin

    REST API

    xdcr update cluster ref

    8214

    Remote cluster reference was updated

    N

    Admin

    REST API

    xdcr delete cluster ref

    8215

    Remote cluster reference was deleted

    N

    Admin

    REST API

    xdcr create replication

    8216

    XDCR replication was created

    N

    Admin

    REST API

    xdcr update replication

    8217

    XDCR replication was updated

    N

    Admin

    REST API

    xdcr cancel replication

    8218

    XDCR replication was canceled

    N

    Admin

    REST API

    xdcr update global settings

    8219

    Global XDCR settings were updated

    N

    Admin

    REST API

    enable auto failover

    8220

    Auto Failover was enabled

    N

    Admin

    REST API

    disable auto failover

    8221

    Auto Failover was disabled

    N

    Admin

    REST API

    reset auto failover count

    8222

    Count for Auto Failover was reset

    N

    Admin

    REST API

    enable cluster alerts

    8223

    Cluster alerts were enabled

    N

    Admin

    REST API

    disable cluster alerts

    8224

    Cluster alerts were disabled

    N

    Admin

    REST API

    modify compaction settings

    8225

    Compaction settings were modified

    N

    Admin

    REST API

    regenerate certificate

    8226

    Self-signed SSL certificate was regenerated

    N

    Admin

    REST API

    setup ldap

    8227

    LDAP Auth settings were modified

    N

    Admin

    REST API

    internal settings

    8228

    Internal Settings

    N

    Admin

    REST API

    upload cluster ca

    8229

    Upload cluster CA

    N

    Admin

    REST API

    reload node certificate

    8230

    Reload node certificate chain and pkey from inbox

    N

    Admin

    REST API

    modify index storage mode

    8231

    Modify Index Storage Mode

    N

    Admin

    REST API

    set user

    8232

    User was added or updated

    N

    Admin

    REST API

    master password change

    8233

    Master password change was requested

    N

    Admin

    REST API

    encryption key rotation

    8234

    Encryption key rotation was requested

    N

    Admin

    REST API

    password policy

    8235

    Password policy was changed

    N

    Admin

    REST API

    client cert auth

    8236

    Client certificate authentication settings changed

    N

    Admin

    REST API

    security settings

    8237

    Security Settings

    N

    Admin

    REST API

    start log collection

    8238

    Log collection run was started

    N

    Admin

    REST API

    modify log redaction settings

    8239

    Log redaction settings were modified

    N

    Admin

    REST API

    configured audit daemon

    8240

    loaded configuration file for audit daemon

    N

    Admin

    REST API

    modify index settings

    8241

    Index service settings were modified

    N

    Admin

    REST API

    modify query settings

    8242

    Query service settings were modified

    N

    Admin

    REST API

    mutate document

    8243

    Document was mutated via the REST API

    Y

    Data

    REST API

    set user group

    8244

    User group was added or updated

    N

    Admin

    REST API

    delete user group

    8245

    User group was deleted

    N

    Admin

    REST API

    modify ldap settings

    8246

    Ldap settings were modified

    N

    Admin

    REST API

    developer preview settings

    8247

    Developer preview settings

    N

    Admin

    REST API

    license settings

    8248

    License settings

    N

    Admin

    REST API

    set user profile

    8249

    UI profile was added or updated

    N

    Admin

    REST API

    deleted user profile

    8250

    UI profile was deleted

    N

    Admin

    REST API

    modify retry rebalance

    8251

    Retry rebalance settings were modified

    N

    Admin

    REST API

    enable auto reprovision

    8252

    Auto reprovision was enabled

    N

    Admin

    REST API

    disable auto reprovision

    8253

    Auto reprovision was disabled

    N

    Admin

    REST API

    failover settings

    8254

    Failover settings

    N

    Admin

    REST API

    read document

    8255

    Document was read via the REST API

    Y

    Data

    REST API

    logout success

    8256

    Successful logout of couchbase cluster

    N

    Admin

    REST API

    alert email sent

    8257

    An alert email was successfully sent

    Y

    Admin

    REST API

    session timeout

    8258

    User session has ended due to a timeout

    N

    Admin

    Data Service Events

    The following events are generated by the Data Service, in response to attempts to access and modify data.

    Event Group Event Name ID Description Filter? Event Type

    Data Service

    opened DCP connection

    20480

    opened DCP connection

    N

    Admin

    Data Service

    authentication failed

    20481

    authentication failed

    N

    Admin

    Data Service

    external memcached bucket flush

    20482

    External user flushed the content of a memcached bucket

    N

    Admin

    Data Service

    invalid packet

    20483

    Rejected an invalid packet

    N

    Admin

    Data Service

    command access failure

    20484

    Rejected access to a command

    N

    Admin

    Data Service

    authentication succeeded

    20485

    Authentication to the cluster succeeded

    N

    Admin

    Data Service

    privilege debug configured

    20486

    The state of the privilege debug mode changed

    N

    Admin

    Data Service

    privilege debug

    20487

    Access to a resource was granted due to privilege debug

    N

    Admin

    Data Service

    document read

    20488

    Document was read

    Y

    Data

    Data Service

    document locked

    20489

    Document was locked

    Y

    Data

    Data Service

    document modify

    20490

    Document was modified

    Y

    Data

    Data Service

    document delete

    20491

    Document was deleted

    Y

    Data

    Data Service

    select bucket

    20492

    The specified bucket was selected

    Y

    Admin

    Query and Index Service Events

    The following events are generated by the Query and Index Services, in response to statement-executions and API access-attempts.

    Event Group Event Name ID Description Filter? Event Type

    Query and Index Services

    SELECT statement

    28672

    A N1QL SELECT statement was executed

    Y

    Data

    Query and Index Services

    EXPLAIN statement

    28673

    A N1QL EXPLAIN statement was executed

    Y

    Data

    Query and Index Services

    PREPARE statement

    28674

    A N1QL PREPARE statement was executed

    Y

    Data

    Query and Index Services

    INFER statement

    28675

    A N1QL INFER statement was executed

    Y

    Data

    Query and Index Services

    INSERT statement

    28676

    A N1QL INSERT statement was executed

    Y

    Data

    Query and Index Services

    UPSERT statement

    28677

    A N1QL UPSERT statement was executed

    Y

    Data

    Query and Index Services

    DELETE statement

    28678

    A N1QL DELETE statement was executed

    Y

    Data

    Query and Index Services

    UPDATE statement

    28679

    A N1QL UPDATE statement was executed

    Y

    Data

    Query and Index Services

    MERGE statement

    28680

    A N1QL MERGE statement was executed

    Y

    Data

    Query and Index Services

    CREATE INDEX statement

    28681

    A N1QL CREATE INDEX statement was executed

    Y

    Data

    Query and Index Services

    DROP INDEX statement

    28682

    A N1QL DROP INDEX statement was executed

    Y

    Data

    Query and Index Services

    ALTER INDEX statement

    28683

    A N1QL ALTER INDEX statement was executed

    Y

    Data

    Query and Index Services

    BUILD INDEX statement

    28684

    A N1QL BUILD INDEX statement was executed

    Y

    Data

    Query and Index Services

    GRANT ROLE statement

    28685

    A N1QL GRANT ROLE statement was executed

    Y

    Admin

    Query and Index Services

    REVOKE ROLE statement

    28686

    A N1QL REVOKE ROLE statement was executed

    Y

    Admin

    Query and Index Services

    UNRECOGNIZED statement

    28687

    An unrecognized statement was received by the N1QL query engine

    Y

    Admin

    Query and Index Services

    CREATE PRIMARY INDEX statement

    28688

    A N1QL CREATE PRIMARY INDEX statement was executed

    Y

    Data

    Query and Index Services

    /admin/stats API request

    28689

    An HTTP request was made to the API at /admin/stats

    Y

    Admin

    Query and Index Services

    /admin/vitals API request

    28690

    An HTTP request was made to the API at /admin/vitals

    Y

    Admin

    Query and Index Services

    /admin/prepareds API request

    28691

    An HTTP request was made to the API at /admin/prepareds

    Y

    Admin

    Query and Index Services

    /admin/active_requests API request

    28692

    An HTTP request was made to the API at /admin/active_requests

    Y

    Admin

    Query and Index Services

    /admin/indexes/prepareds API request

    28693

    An HTTP request was made to the API at /admin/indexes/prepareds

    Y

    Admin

    Query and Index Services

    /admin/indexes/active_requests API request

    28694

    An HTTP request was made to the API at /admin/indexes/active_requests

    Y

    Admin

    Query and Index Services

    /admin/indexes/completed_requests API request

    28695

    An HTTP request was made to the API at /admin/indexes/completed_requests

    Y

    Admin

    Query and Index Services

    /admin/ping API request

    28697

    An HTTP request was made to the API at /admin/ping

    Y

    Admin

    Query and Index Services

    /admin/config API request

    28698

    An HTTP request was made to the API at /admin/config

    Y

    Admin

    Query and Index Services

    /admin/ssl_cert API request

    28699

    An HTTP request was made to the API at /admin/ssl_cert

    Y

    Admin

    Query and Index Services

    /admin/settings API request

    28700

    An HTTP request was made to the API at /admin/settings

    Y

    Admin

    Query and Index Services

    /admin/clusters API request

    28701

    An HTTP request was made to the API at /admin/clusters

    Y

    Admin

    Query and Index Services

    /admin/completed_requests API request

    28702

    An HTTP request was made to the API at /admin/completed_requests

    Y

    Admin

    Query and Index Services

    N1QL configuration

    28703

    States that N1QL is using audit configuration with specified uuid

    N

    Admin

    Query and Index Services

    /admin/functions API request

    28704

    An HTTP request was made to the API at /admin/functions.

    Y

    Admin

    Query and Index Services

    /admin/indexes/functions API request

    28705

    An HTTP request was made to the API at /admin/indexes/functions.

    Y

    Admin

    Search Service Events

    The following events are generated by the Search Service, in response to index and configuration changes, garbage collection, and resource profiling.

    Event Group Event Name ID Description Filter? Event Type

    Search Service

    Delete index

    24576

    FTS index was deleted

    N

    Data

    Search Service

    Create/Update index

    24577

    FTS index was created/Updated

    N

    Data

    Search Service

    Control index

    24579

    FTS index control command was issued

    N

    Data

    Search Service

    Config refresh

    24580

    FTS config was refreshed

    N

    Admin

    Search Service

    Config replan

    24581

    FTS config was replanned

    N

    Admin

    Search Service

    GC run

    24582

    GC run was triggered

    N

    Admin

    Search Service

    CPU profile

    24583

    CPU profiling was started

    N

    Admin

    Search Service

    Memory profile

    24584

    Memory profiling was started

    N

    Admin

    Eventing Service Events

    The following events are generated by the Eventing Service, in response to the definition, deployment, and execution of functions; debugging activities; configuration changes; and the importing and exporting of functions.

    Event Group Event Name ID Description Filter? Event Type

    Eventing Service

    Create Function

    32768

    Eventing function definition was created or updated

    Y

    Admin

    Eventing Service

    Delete Function

    32769

    Eventing function definition was deleted

    Y

    Admin

    Eventing Service

    Fetch Functions

    32770

    Eventing function definition was read

    Y

    Admin

    Eventing Service

    List Deployed

    32771

    Eventing deployed functions list was read

    Y

    Admin

    Eventing Service

    Fetch Drafts

    32772

    Eventing function draft definitions were read

    Y

    Admin

    Eventing Service

    Delete Drafts

    32773

    Eventing function draft definitions were deleted

    Y

    Admin

    Eventing Service

    Save Draft

    32774

    Save a draft definition to the store

    Y

    Admin

    Eventing Service

    Start Debug

    32775

    Start eventing function debugger

    Y

    Admin

    Eventing Service

    Stop Debug

    32776

    Stop eventing function debugger

    Y

    Admin

    Eventing Service

    Start Tracing

    32777

    Start tracing eventing function execution

    Y

    Admin

    Eventing Service

    Stop Tracing

    32778

    Stop tracing eventing function execution

    Y

    Admin

    Eventing Service

    Set Settings

    32779

    Save settings for a given app

    Y

    Admin

    Eventing Service

    Fetch Config

    32780

    Get config for eventing

    Y

    Admin

    Eventing Service

    Save Config

    32781

    Save config for eventing

    Y

    Admin

    Eventing Service

    Cleanup Eventing

    32782

    Clears up app definitions and settings from metakv

    Y

    Admin

    Eventing Service

    Get Settings

    32783

    Get settings for a given app

    Y

    Admin

    Eventing Service

    Import Functions

    32784

    Import a list of functions

    Y

    Admin

    Eventing Service

    Export Functions

    32785

    Export the list of functions

    Y

    Admin

    Eventing Service

    List Running

    32786

    Eventing running function list was read

    Y

    Admin

    Analytics Service Events

    The following events are generated by the Analytics Service, in response to configuration changes and statement executions.

    Event Group Event Name ID Description Filter? Event Type

    Analytics Service

    Service configuration change

    36865

    A successful service configuration change was made

    Y

    Admin

    Analytics Service

    Node configuration change

    36866

    A successful node configuration change was made

    Y

    Admin

    Analytics Service

    SELECT statement

    36867

    A N1QL SELECT statement was executed

    Y

    Data

    Analytics Service

    CREATE DATAVERSE statement

    36868

    A N1QL CREATE DATAVERSE statement was executed

    Y

    Data

    Analytics Service

    DROP DATAVERSE statement

    36869

    A N1QL DROP DATAVERSE statement was executed

    Y

    Data

    Analytics Service

    CREATE DATASET statement

    36870

    A N1QL CREATE DATASET statement was executed

    Y

    Data

    Analytics Service

    DROP DATASET statement

    36871

    A N1QL DROP DATASET statement was executed

    Y

    Data

    Analytics Service

    CREATE INDEX statement

    36872

    A N1QL CREATE INDEX statement was executed

    Y

    Data

    Analytics Service

    DROP INDEX statement

    36873

    A N1QL DROP INDEX statement was executed

    Y

    Data

    Analytics Service

    CONNECT LINK statement

    36877

    A N1QL CONNECT LINK statement was executed

    Y

    Data

    Analytics Service

    DISCONNECT LINK statement

    36878

    A N1QL DISCONNECT LINK statement was executed

    Y

    Data

    Analytics Service

    UNRECOGNIZED statement

    36879

    An UNRECOGNIZED N1QL statement was encountered

    Y

    Admin

    View Engine Events

    The following events are generated by the View Engine.

    Event Group Event Name ID Description Filter? Event Type

    View Engine

    Create Design Doc

    40960

    Design Doc is Created

    Y

    Data

    View Engine

    Delete Design Doc

    40961

    Design Doc is Deleted

    Y

    Data

    View Engine

    Query DDoc Meta Data

    40962

    Design Doc Meta Data Query Request

    Y

    Data

    View Engine

    View Query

    40963

    View Query Request

    Y

    Data

    View Engine

    Update Design Doc

    40964

    Design Doc is Updated

    Y

    Data

    View Engine

    Audit Configuration change

    40965

    Change in Audit Configuration

    N

    Admin

    Audit Events

    The following events are generated by the audit daemon itself.

    Event Group Event Name ID Description Filter? Event Type

    Audit

    configured audit daemon

    4096

    Loaded configuration file for audit daemon

    N

    Admin

    Audit

    shutting down audit daemon

    4097

    The audit daemon is being shut down

    N

    Admin