Audit File Details

Audit File Details

Couchbase Server captures audit details in specified audit fields.

The table shows audit details with their descriptions.

Table 1. Audit record content
Field Type Description
type string This is the type of the audit. For example: Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate, and so on.
timestamp document Contains the date and UTC time of the event in the ISO 8601 format. For example,
local document

{ip: <String>, 
port: <int>},
A JSON document that contains the local IP address and the port number of the running instance.
remote document

{ip: <String>, 
port: <int>},
A JSON document that contains the remote IP address and the port number in addition to the information about the service that was used on the incoming connection associated with the event.

Possible services include: cbmcd, cbhttp, cbmgmt, cbxdcr, cbn1ql, cbsyncgw.

userid string A string that identifies the userID.
params document Depends on the event type. For example, for a bucket operation, it will capture the bucket name.
result integer or string This is the error code or a message of the operation that was tried.
Note: The audit capture for different administrator events may have different fields depending on the event type. However, every audit event will register who does what, when, and how.