SQL++ Auditing

This section provides specific information on Couchbase Server auditing as it relates to SQL++. For a general description of auditing with Couchbase Server, see Auditing.

Couchbase Server provides auditing for SQL++-related activities such as the following:

SQL++-related activities are logged whether they are executed by a person or by an application running on behalf of a person. Auditing occurs at the level of requests, rather than of operations. Thus, when a request arrives with a SELECT query, only the SELECT query itself is logged: the associated subsidiary operations performed by the Data and Index Services are not logged.

Auditing causes a reduction in SQL++ query-performance. This is in the range of 9% to 17% of queries performed per second: the exact reduction depends on query-size, and on the amount of auditing that has been enabled. Large queries and minimal auditing cause less performance-reduction.

Auditing can be configured by means of Couchbase Web Console: see the information provided in Manage Auditing. To capture SQL++-related events, use the Query and Index Service panel. Events available to be audited include ones issued through the SDK, the Query workbench, and the Query Shell.

The audit records are written in JSON format to match the format used for Admin Auditing to allow easy integration with downstream auditing tools for audit log analysis. The syslog format will allow for integration with third party SIEM tools, such as QRadar.

To reduce disk usage and improve performance, the log files are as compact as possible.

To make the log entry easier-to-read, use a formatting utility such as jq.

The auditing Rotation parameters can be only one of the following:

When the audit target fails, the auditing system can be set to one of the following:

If an audit record attempt fails in the query engine, an error message will be printed to the query.log file.

To prevent unauthorized modification of the audit service configuration, the auditing system restricts access to configuring only to Full and Local User Security Administrators.

Audit records are immutable since the auditing system prevents changes of audit event records once written.

Once archived, audit data is deleted from Couchbase, and the file space is recovered.

The cbcollect_info utility does not collect audit logs.

Below is the list of all events that are captured in the audit logs.

Items that will not be captured in the audit logs:

Audit records will be issued by the query engine for requests to its secondary APIs. This does not include the main URL used for queries (/query/service) but does include all other URLs the query engine listens to.

There will be a separate audit record code for each registered URL. The mapping from URLs to audit record codes is given below. Some URLs require extra fields, as noted.