A newer version of this documentation is available.

Audit File Details

Couchbase Server captures audit details in specified audit fields.

The table shows audit details with their descriptions.

Table 1. Audit record content
Field	Type	Description
`type`	string	This is the type of the audit. For example: Login, Startup, Shutdown, Password, AuditStart, AuditStop, AuditTruncate, and so on.
`timestamp`	document	Contains the date and UTC time of the event in the ISO 8601 format. For example, `http://www.w3.org/TR/NOTE-datetime`
`local`	document {ip: <String>, port: <int>},	A JSON document that contains the local IP address and the port number of the running instance.
`remote`	document {ip: <String>, port: <int>},	A JSON document that contains the remote IP address and the port number in addition to the information about the service that was used on the incoming connection associated with the event. Possible services include: `cbmcd`, `cbhttp`, `cbmgmt`, `cbxdcr`, `cbn1ql`, `cbsyncgw`.
`userid`	string	A string that identifies the userID.
`params`	document	Depends on the event type. For example, for a bucket operation, it will capture the bucket name.
`result`	integer or string	This is the error code or a message of the operation that was tried.

The audit capture for different administrator events may have different fields depending on the event type. However, every audit event will register who does what, when, and how.