Please use the form below to provide your feedback. Because your feedback is valuable to us, the information you submit in this form is recorded in our issue tracking system (JIRA), which is publicly available. You can track the status of your feedback using the ticket number displayed in the dialog once you submit the form.

A newer version of this documentation is available.

View Latest

Audit Logging Events Reference

      +
      Audit Logging provides tools for administrators to track operational irregularities and to support regulatory and security compliance standards, such as HIPAA and SOC-2. Below is a list of possible Audit Events.

      About Audit Events

      You can use audit events to track and provide context on user activity within your application.

      Table 1. Events table field description

      Field Name

      Description

      ID

      A unique number used to distinguish between Audit Events. You can use the value to specify which events will be present or written to your audit logs, either globally or on a database level.

      Name

      A short descriptive name, this will be outputted as a field in the audit log.

      Description

      A longer name, this is will be outputted as a field in the audit log.

      DefaultEnabled

      If true, the given Audit Event is enabled by default.

      Filterable

      If true, the given audit event can be disabled.

      EventScope

      The scope of the event. This can be Global or Database. You can configure global scope events via the bootstrap config, and database events via the Admin REST API.

      EventType

      The type of action performed by the event. This can be user, admin, or data.

      MandatoryFields

      Fields that are always present in a given Audit Event.

      OptionalFields

      May or may not be present in a given Audit Event.

      Audit Event Types

      Audit Events can be one of the following types:

      • Admin - Events that track administrative and configuration changes.

      • Data - Events that track attempts to access and change data.

      • User - Events that track end-user operations.

      Audit Event Scopes

      Audit events have scope, this affects how they can be configured. The audit events scopes are:

      • Database - These events are specific to a database such as AuditIDDocumentUpdate 55002, and can only be enabled/disabled at the database configuration level. Database level audit events are segregated into per Sync Gateway database specific audit logs.

      • Global - These events are considered global such as AuditIDSyncGatewayStartup 53260, and have to be enabled/disabled in the bootstrap config.

      Auditing Events

      ID Name Description DefaultEnabled Filterable EventScope EventType Fields

      53248

      Auditing enabled

      Audit logging was enabled

      TRUE

      FALSE

      Global

      admin

      audit_scope, description, id, name, timestamp, db

      53249

      Auditing disabled

      Audit logging was disabled

      TRUE

      FALSE

      Global

      admin

      audit_scope, description, id, name, timestamp

      53250

      Auditing configuration changed

      Audit logging configuration was changed

      TRUE

      FALSE

      Global

      admin

      audit_scope, cid, db, description, id, local, name, payload, real_userid, remote, timestamp

      Sync Gateway Events

      ID Name Description DefaultEnabled Filterable EventScope EventType Fields

      53260

      Sync Gateway startup

      Sync Gateway started

      TRUE

      FALSE

      Global

      admin

      admin_interface_authentication, bcrypt_cost, description, disable_persistent_config, id, log_file_path, metrics_interface_authentication, name, server_tls_skip_verify, sg_version, timestamp, use_tls_server

      53270

      Public HTTP API request

      Public HTTP API request was made

      FALSE

      TRUE

      Global

      user

      cid, description, http_method, http_path, http_status, id, local, name, remote, timestamp, real_userid, request_body

      53271

      Admin HTTP API request

      Admin HTTP API request was made

      FALSE

      TRUE

      Global

      admin

      cid, description, http_method, http_path, http_status, id, local, name, remote, timestamp, real_userid, request_body

      53272

      Metrics HTTP API request

      Metrics HTTP API request was made

      FALSE

      TRUE

      Global

      admin

      cid, description, http_method, http_path, http_status, id, local, name, remote, timestamp, real_userid, request_body

      53280

      Public API user authenticated

      Public API user successfully authenticated

      TRUE

      TRUE

      Database

      user

      auth_method, description, id, name, timestamp, oidc_issuer

      53281

      Public API user authentication failed

      Public API user failed to authenticate

      TRUE

      TRUE

      Database

      user

      auth_method, description, id, name, timestamp, username

      53282

      Public API user session created

      Public API user session was created

      TRUE

      TRUE

      Database

      user

      description, id, name, session_id, timestamp, username

      53283

      Public API user session deleted

      Public API user session was deleted

      TRUE

      TRUE

      Database

      user

      description, id, name, session_id, timestamp, username

      53284

      Public API user all sessions deleted

      All sessions were deleted for a Public API user

      TRUE

      TRUE

      Database

      user

      description, id, name, timestamp, username

      53290

      Admin API user authenticated

      Admin API user successfully authenticated

      TRUE

      TRUE

      Database

      admin

      description, id, name, timestamp

      53291

      Admin API user authentication failed

      Admin API user failed to authenticate

      TRUE

      TRUE

      Database

      admin

      description, id, name, timestamp, username

      53292

      Admin API user authorization failed

      Admin API user failed to authorize

      TRUE

      TRUE

      Database

      admin

      description, id, name, timestamp, username

      53300

      sgcollect_info status

      sgcollect_info status was viewed

      TRUE

      TRUE

      Global

      admin

      cid, description, id, local, name, real_userid, remote, timestamp

      53301

      sgcollect_info start

      sgcollect_info was started

      TRUE

      TRUE

      Global

      admin

      cid, customer, description, id, keep_zip, local, name, output_dir, real_userid, remote, ticket, timestamp, upload_host, zip_filename

      53302

      sgcollect_info stop

      sgcollect_info was stopped

      TRUE

      TRUE

      Global

      admin

      cid, description, id, local, name, real_userid, remote, timestamp

      53303

      stats requested

      stats were requested

      FALSE

      TRUE

      Global

      admin

      cid, description, id, local, name, real_userid, remote, stats_format, timestamp

      53304

      profiling requested

      profiling was requested

      TRUE

      TRUE

      Global

      admin

      description, id, name, profile_type, timestamp, filename

      53350

      Sync Gateway cluster info read

      Sync Gateway cluster info was viewed

      TRUE

      TRUE

      Global

      admin

      description, id, name, timestamp

      Database Events

      ID Name Description DefaultEnabled Filterable EventScope EventType Fields

      54000

      Create database

      A new database was created

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, payload, real_userid, remote, timestamp

      54001

      Read database

      Information about this database was viewed

      FALSE

      TRUE

      Database

      user

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54002

      Delete database

      A database was deleted

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54003

      Read all databases

      All databases were viewed

      FALSE

      TRUE

      Global

      admin

      cid, db_names, description, id, local, name, real_userid, remote, timestamp

      54010

      Read database config

      Database configuration was viewed

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54011

      Update database config

      Database configuration was updated

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, payload, real_userid, remote, timestamp

      54020

      Database offline

      Database was taken offline

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54021

      Database online

      Database was brought online

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54030

      Database compaction status

      Database compaction status was viewed

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp, type

      54031

      Database attachment compaction start

      Database attachment compaction was started

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp, type, dry_run, reset

      54032

      Database compaction stop

      Database compaction was stopped

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp, type

      54040

      Database resync status

      Database resync status was viewed

      FALSE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54041

      Database resync start

      Database resync was started

      TRUE

      TRUE

      Database

      admin

      cid, collections, db, description, id, local, name, real_userid, regenerate_sequences, remote, reset, timestamp

      54042

      Database resync stop

      Database resync was stopped

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54043

      Post-upgrade

      Post-upgrade was run for Sync Gateway databases

      TRUE

      TRUE

      Global

      admin

      cid, description, id, local, name, preview, real_userid, remote, timestamp

      54044

      Database repair

      Database repair was run

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54045

      Database flush

      Database flush was run

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      User and Role Administration Events

      ID Name Description DefaultEnabled Filterable EventScope EventType Fields

      54100

      Create user

      A new user was created

      TRUE

      TRUE

      Database

      admin

      channels, db, description, id, name, roles, timestamp, username

      54101

      Read user

      Information about this user was viewed

      TRUE

      TRUE

      Database

      admin

      db, description, id, name, timestamp, username

      54102

      Update user

      User was updated

      TRUE

      TRUE

      Database

      admin

      channels, db, description, id, name, roles, timestamp, username

      54103

      Delete user

      User was deleted

      TRUE

      TRUE

      Database

      admin

      db, description, id, name, timestamp, username

      54104

      Read all users

      List of all users was viewed

      TRUE

      TRUE

      Database

      admin

      db, description, id, name, name_only, timestamp, limit

      54110

      Create role

      A new role was created

      TRUE

      TRUE

      Database

      admin

      admin_channels, db, description, id, name, role, timestamp

      54111

      Read role

      Information about this role was viewed

      TRUE

      TRUE

      Database

      admin

      db, description, id, name, role, timestamp

      54112

      Update role

      Role was updated

      TRUE

      TRUE

      Database

      admin

      admin_channels, db, description, id, name, role, timestamp

      54113

      Delete role

      Role was deleted

      TRUE

      TRUE

      Database

      admin

      db, description, id, name, role, timestamp

      54114

      Read all roles

      List of all roles was viewed

      TRUE

      TRUE

      Database

      admin

      db, description, id, include_deleted, name, timestamp, limit

      Replication Events

      ID Name Description DefaultEnabled Filterable EventScope EventType Fields

      54200

      Changes feed started

      Changes feed was started

      TRUE

      TRUE

      Database

      data

      cid, db, description, id, ks, local, name, real_userid, remote, since, timestamp, channels, doc_ids, feed_type, filter, include_docs

      54300

      Replication connect

      A replication client connected

      TRUE

      TRUE

      Database

      user

      cid, client_type, db, description, id, local, name, real_userid, remote, timestamp, client_version

      54301

      Replication disconnect

      A replication client disconnected

      TRUE

      TRUE

      Database

      user

      cid, client_type, db, description, id, local, name, real_userid, remote, timestamp

      54400

      Create Inter-Sync Gateway Replication

      A new Inter-Sync Gateway Replication was created

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, payload, real_userid, remote, replication_id, timestamp

      54401

      Read Inter-Sync Gateway Replication

      Information about this Inter-Sync Gateway Replication was viewed

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, replication_id, timestamp

      54402

      Update Inter-Sync Gateway Replication

      Inter-Sync Gateway Replication was updated

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, payload, real_userid, remote, replication_id, timestamp

      54403

      Delete Inter-Sync Gateway Replication

      Inter-Sync Gateway Replication was deleted

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, replication_id, timestamp

      54410

      Inter-Sync Gateway Replication status

      Inter-Sync Gateway Replication status was document viewed

      FALSE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, replication_id, timestamp

      54411

      Inter-Sync Gateway Replication start

      Inter-Sync Gateway Replication was started

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, replication_id, timestamp

      54412

      Inter-Sync Gateway Replication stop

      Inter-Sync Gateway Replication was stopped

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, replication_id, timestamp

      54413

      Inter-Sync Gateway Replication reset

      Inter-Sync Gateway Replication was reset

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, replication_id, timestamp

      54420

      All Inter-Sync Gateway Replication status

      All Inter-Sync Gateway Replication statuses were viewed

      FALSE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp

      54421

      Read all Inter-Sync Gateway Replications

      All Inter-Sync Gateway Replications were viewed

      TRUE

      TRUE

      Database

      admin

      cid, db, description, id, local, name, real_userid, remote, timestamp
      ID Name Description DefaultEnabled Filterable EventScope EventType Fields

      55000

      Create document

      A new document was created

      FALSE

      TRUE

      Database

      data

      db, description, doc_id, doc_version, id, ks, name, real_userid, timestamp, cid, local, remote

      55001

      Read document

      A document was viewed

      FALSE

      TRUE

      Database

      data

      db, description, doc_id, doc_version, id, ks, name, real_userid, timestamp, cid, local, remote

      55002

      Update document

      A document was updated

      FALSE

      TRUE

      Database

      data

      db, description, doc_id, doc_version, id, ks, name, real_userid, timestamp, cid, local, remote

      55003

      Delete document

      A document was deleted

      FALSE

      TRUE

      Database

      data

      db, description, doc_id, id, ks, name, real_userid, timestamp, cid, doc_version, local, purged, remote

      55004

      Read document metadata

      Document metadata was viewed

      FALSE

      TRUE

      Database

      data

      cid, db, description, doc_id, id, ks, local, name, real_userid, remote, timestamp

      55005

      Import document

      A document was imported

      FALSE

      TRUE

      Database

      data

      db, description, doc_id, doc_version, id, ks, name, timestamp

      55006

      Resync document

      A document was resynced

      FALSE

      TRUE

      Database

      data

      db, description, doc_id, doc_version, id, ks, name, timestamp

      55007

      Revoke document

      A document revocation request was sent to a client

      FALSE

      TRUE

      Database

      data

      db, description, doc_id, doc_version, id, ks, name, timestamp

      55010

      Create attachment

      A new attachment was created

      FALSE

      TRUE

      Database

      data

      attachment_id, db, description, doc_id, doc_version, id, ks, name, real_userid, timestamp, cid, local, remote

      55011

      Read attachment

      An attachment was viewed

      FALSE

      TRUE

      Database

      data

      attachment_id, db, description, doc_id, doc_version, id, ks, name, real_userid, timestamp, cid, local, remote

      55012

      Update attachment

      An attachment was updated

      FALSE

      TRUE

      Database

      data

      attachment_id, db, description, doc_id, doc_version, id, ks, name, real_userid, timestamp, cid, local, remote

      55013

      Delete attachment

      An attachment was deleted

      FALSE

      TRUE

      Database

      data

      attachment_id, db, description, doc_id, id, ks, name, real_userid, timestamp, cid, doc_version, local, remote

      See Also