Audit File Details

Audit File Details

Couchbase Server captures audit details in specified audit fields.

The table below contains some frequently used audit fields with corresponding descriptions. Note that different event-types generate different field-subsets.

Table 1. Audit record content
Field Type Description
type string The audit-type. For example, Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate.
timestamp document Contains the date and UTC time of the event in ISO 8601 format. For example, http://www.w3.org/TR/NOTE-datetime.
id integer A unique identifier for the event-type.
local document
{ip: <String>, 
port: <int>},
A JSON document that contains the local IP-address and the port-number of the running instance.
remote document
{ip: <String>, 
port: <int>},
A JSON document that contains the remote IP-address, the port-number, and additional information on the service used on the incoming connection associated with the event.

Possible services include cbmcd, cbhttp, cbmgmt, cbxdcr, cbn1ql, and cbsyncgw.

user string A string that identifies the user.
params document Information dependent on the event-type. For example, for a bucket-operation, the bucket name is captured.
result integer or string An error-code or other message, related to the attempted operation.