Audit Event Reference
A complete list of the events audited by Couchbase Server.
Audit Events
The Couchbase Server auditing facility recognizes specific events, which can be selectively logged. The output is written to a log-file, which is periodically rotated.
An overview of event-auditing is provided in Auditing. An explanation of how to enable the auditing and filtering of certain events is provided in Manage Auditing.
The current page lists all events that can be audited.
Event Tables
The events listed in the following tables support the auditing of administrative and data changes, made on the cluster.
In each table, the first column (at the left) features the event-group heading (thereby repeating the table’s title, so as to ensure readability throughout the longer tables). The second column provides the event name. The third column provides the id for the event. The fourth column provides a description of the event; the fifth describes whether it is filterable; and the sixth indicates whether the event is classified as Data or Admin.
The tables — which are for the REST API, the Data Service, XDCR, the Query and Index Services, the Search Service, the Eventing Service, the Analytics Service, the Backup Service, the View Engine, and the Audit facility itself — are as follows.
REST API Events
The following events are generated by Couchbase Server in response to calls made with the REST API.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
REST API |
login success |
8192 |
Successful login to cluster |
N |
Admin |
REST API |
login failure |
8193 |
Unsuccessful attempt to login to cluster |
N |
Admin |
REST API |
delete user |
8194 |
User was deleted |
N |
Admin |
REST API |
user credentials change |
8195 |
User credentials were changed |
N |
Admin |
REST API |
add node |
8196 |
Node was added to the cluster |
N |
Admin |
REST API |
remove node |
8197 |
Node was removed from the cluster |
N |
Admin |
REST API |
failover nodes |
8198 |
Nodes that were failed over |
N |
Admin |
REST API |
enter node recovery |
8199 |
Entered node recovery |
N |
Admin |
REST API |
rebalance initiated |
8200 |
Rebalance was initiated |
N |
Admin |
REST API |
create bucket |
8201 |
Bucket was created |
N |
Admin |
REST API |
modify bucket |
8202 |
Bucket was modified |
N |
Admin |
REST API |
delete bucket |
8203 |
Bucket was deleted |
N |
Admin |
REST API |
flush bucket |
8204 |
Bucket was flushed |
N |
Admin |
REST API |
start loading sample |
8205 |
Started loading sample |
N |
Admin |
REST API |
disk storage conf |
8206 |
Disk storage configuration was set |
N |
Admin |
REST API |
rename node |
8207 |
The node was renamed |
N |
Admin |
REST API |
setup node services |
8208 |
The services were set for the node |
N |
Admin |
REST API |
change cluster settings |
8209 |
Cluster settings were changed |
N |
Admin |
REST API |
add group |
8210 |
Server group was added |
N |
Admin |
REST API |
delete group |
8211 |
Server group was deleted |
N |
Admin |
REST API |
update group |
8212 |
Server group was updated |
N |
Admin |
REST API |
enable auto failover |
8220 |
Auto Failover was enabled |
N |
Admin |
REST API |
disable auto failover |
8221 |
Auto Failover was disabled |
N |
Admin |
REST API |
reset auto failover count |
8222 |
Count for Auto Failover was reset |
N |
Admin |
REST API |
enable cluster alerts |
8223 |
Cluster alerts were enabled |
N |
Admin |
REST API |
disable cluster alerts |
8224 |
Cluster alerts were disabled |
N |
Admin |
REST API |
modify compaction settings |
8225 |
Compaction settings were modified |
N |
Admin |
REST API |
regenerate certificate |
8226 |
Self-signed SSL certificate was regenerated |
N |
Admin |
REST API |
setup ldap |
8227 |
LDAP Auth settings were modified |
N |
Admin |
REST API |
internal settings |
8228 |
Internal Settings |
N |
Admin |
REST API |
upload cluster ca |
8229 |
Upload cluster CA |
N |
Admin |
REST API |
reload node certificate |
8230 |
Reload node certificate chain and pkey from inbox |
N |
Admin |
REST API |
modify index storage mode |
8231 |
Modify Index Storage Mode |
N |
Admin |
REST API |
set user |
8232 |
User was added or updated |
N |
Admin |
REST API |
master password change |
8233 |
Master password change was requested |
N |
Admin |
REST API |
encryption key rotation |
8234 |
Encryption key rotation was requested |
N |
Admin |
REST API |
password policy |
8235 |
Password policy was changed |
N |
Admin |
REST API |
client cert auth |
8236 |
Client certificate authentication settings changed |
N |
Admin |
REST API |
security settings |
8237 |
Security Settings |
N |
Admin |
REST API |
start log collection |
8238 |
Log collection run was started |
N |
Admin |
REST API |
modify log redaction settings |
8239 |
Log redaction settings were modified |
N |
Admin |
REST API |
configured audit daemon |
8240 |
loaded configuration file for audit daemon |
N |
Admin |
REST API |
modify index settings |
8241 |
Index service settings were modified |
N |
Admin |
REST API |
modify query settings |
8242 |
Query service settings were modified |
N |
Admin |
REST API |
mutate document |
8243 |
Document was mutated via the REST API |
Y |
Data |
REST API |
set user group |
8244 |
User group was added or updated |
N |
Admin |
REST API |
delete user group |
8245 |
User group was deleted |
N |
Admin |
REST API |
modify ldap settings |
8246 |
Ldap settings were modified |
N |
Admin |
REST API |
developer preview settings |
8247 |
Developer preview settings |
N |
Admin |
REST API |
license settings |
8248 |
License settings |
N |
Admin |
REST API |
set user profile |
8249 |
UI profile was added or updated |
N |
Admin |
REST API |
deleted user profile |
8250 |
UI profile was deleted |
N |
Admin |
REST API |
modify retry rebalance |
8251 |
Retry rebalance settings were modified |
N |
Admin |
REST API |
enable auto reprovision |
8252 |
Auto reprovision was enabled |
N |
Admin |
REST API |
disable auto reprovision |
8253 |
Auto reprovision was disabled |
N |
Admin |
REST API |
failover settings |
8254 |
Failover settings |
N |
Admin |
REST API |
read document |
8255 |
Document was read via the REST API |
Y |
Data |
REST API |
logout success |
8256 |
Successful logout of couchbase cluster |
N |
Admin |
REST API |
alert email sent |
8257 |
An alert email was successfully sent |
Y |
Admin |
REST API |
session timeout |
8258 |
User session has ended due to a timeout |
N |
Admin |
REST API |
create scope |
8259 |
Scope was created |
N |
Data |
REST API |
drop scope |
8260 |
Scope was dropped |
N |
Data |
REST API |
create collection |
8261 |
Collection was created |
N |
Data |
REST API |
drop collection |
8262 |
Collection was dropped |
N |
Data |
REST API |
set manifest |
8263 |
Setting bucket manifest |
N |
Data |
REST API |
authentication failure |
8264 |
REST operation failed due to authentication failure |
N |
Admin |
REST API |
RBAC information retrieved |
8265 |
RBAC information was retrieved |
Y |
Admin |
REST API |
Admin password reset |
8266 |
Admin password was reset |
N |
Admin |
REST API |
modify analytics settings |
8267 |
Analytics service settings were modified |
N |
Admin |
REST API |
update scope |
8268 |
Scope properties were updated |
N |
Admin |
REST API |
delete cluster ca |
8269 |
Delete cluster CA |
N |
Admin |
REST API |
serverless settings |
8270 |
Serverless settings |
N |
Admin |
Data Service Events
The following events are generated by the Data Service, in response to attempts to access and modify data.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Data Service |
opened DCP connection |
20480 |
opened DCP connection |
N |
Admin |
Data Service |
authentication failed |
20481 |
authentication failed |
N |
Admin |
Data Service |
external memcached bucket flush |
20482 |
External user flushed the content of a memcached bucket |
N |
Admin |
Data Service |
invalid packet |
20483 |
Rejected an invalid packet |
N |
Admin |
Data Service |
command access failure |
20484 |
Rejected access to a command |
N |
Admin |
Data Service |
authentication succeeded |
20485 |
Authentication to the cluster succeeded |
N |
Admin |
Data Service |
privilege debug configured |
20486 |
The state of the privilege debug mode changed |
N |
Admin |
Data Service |
privilege debug |
20487 |
Access to a resource was granted due to privilege debug |
N |
Admin |
Data Service |
document read |
20488 |
Document was read |
Y |
Data |
Data Service |
document locked |
20489 |
Document was locked |
Y |
Data |
Data Service |
document modify |
20490 |
Document was modified |
Y |
Data |
Data Service |
document delete |
20491 |
Document was deleted |
Y |
Data |
Data Service |
select bucket |
20492 |
The specified bucket was selected |
Y |
Admin |
Data Service |
session terminated |
20493 |
Session to the cluster has terminated |
Y |
Admin |
Data Service |
tenant rate limited |
20494 |
The given tenant was rate limited |
Y |
Admin |
XDCR Events
The following events are generated by XDCR.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
XDCR |
remote cluster ref creation |
16384 |
created remote cluster ref |
N |
Admin |
XDCR |
remote cluster ref update |
16385 |
updated remote cluster ref |
N |
Admin |
XDCR |
remote cluster ref deletion |
16386 |
deleted remote cluster ref |
N |
Admin |
XDCR |
replication creation |
16387 |
created replication |
N |
Admin |
XDCR |
replication pause |
16388 |
paused replication |
N |
Admin |
XDCR |
replication resume |
16389 |
resumed replication |
N |
Admin |
XDCR |
replication cancellation |
16390 |
canceled replication |
N |
Admin |
XDCR |
default replication settings update |
16391 |
updated default replication settings |
N |
Admin |
XDCR |
individual replication settings update |
16392 |
updated individual replication settings |
N |
Admin |
XDCR |
bucket settings update |
16393 |
updated bucket settings |
N |
Admin |
XDCR |
authorization failure while adding remote cluster ref |
16394 |
failed to add remote cluster ref because of authorization failure |
N |
Admin |
XDCR |
authorization failure while updating remote cluster ref |
16395 |
failed to update remote cluster ref because of authorization failure |
N |
Admin |
XDCR |
access denied |
16396 |
access denied |
N |
Admin |
Query and Index Service Events
The following events are generated by the Query and Index Services, in response to statement-executions and API access-attempts.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Query and Index Services |
SELECT statement |
28672 |
A N1QL SELECT statement was executed |
Y |
Data |
Query and Index Services |
EXPLAIN statement |
28673 |
A N1QL EXPLAIN statement was executed |
Y |
Data |
Query and Index Services |
PREPARE statement |
28674 |
A N1QL PREPARE statement was executed |
Y |
Data |
Query and Index Services |
INFER statement |
28675 |
A N1QL INFER statement was executed |
Y |
Data |
Query and Index Services |
INSERT statement |
28676 |
A N1QL INSERT statement was executed |
Y |
Data |
Query and Index Services |
UPSERT statement |
28677 |
A N1QL UPSERT statement was executed |
Y |
Data |
Query and Index Services |
DELETE statement |
28678 |
A N1QL DELETE statement was executed |
Y |
Data |
Query and Index Services |
UPDATE statement |
28679 |
A N1QL UPDATE statement was executed |
Y |
Data |
Query and Index Services |
MERGE statement |
28680 |
A N1QL MERGE statement was executed |
Y |
Data |
Query and Index Services |
CREATE INDEX statement |
28681 |
A N1QL CREATE INDEX statement was executed |
Y |
Data |
Query and Index Services |
DROP INDEX statement |
28682 |
A N1QL DROP INDEX statement was executed |
Y |
Data |
Query and Index Services |
ALTER INDEX statement |
28683 |
A N1QL ALTER INDEX statement was executed |
Y |
Data |
Query and Index Services |
BUILD INDEX statement |
28684 |
A N1QL BUILD INDEX statement was executed |
Y |
Data |
Query and Index Services |
GRANT ROLE statement |
28685 |
A N1QL GRANT ROLE statement was executed |
Y |
Admin |
Query and Index Services |
REVOKE ROLE statement |
28686 |
A N1QL REVOKE ROLE statement was executed |
Y |
Admin |
Query and Index Services |
UNRECOGNIZED statement |
28687 |
An unrecognized statement was received by the N1QL query engine |
Y |
Admin |
Query and Index Services |
CREATE PRIMARY INDEX statement |
28688 |
A N1QL CREATE PRIMARY INDEX statement was executed |
Y |
Data |
Query and Index Services |
/admin/stats API request |
28689 |
An HTTP request was made to the API at /admin/stats |
Y |
Admin |
Query and Index Services |
/admin/vitals API request |
28690 |
An HTTP request was made to the API at /admin/vitals |
Y |
Admin |
Query and Index Services |
/admin/prepareds API request |
28691 |
An HTTP request was made to the API at /admin/prepareds |
Y |
Admin |
Query and Index Services |
/admin/active_requests API request |
28692 |
An HTTP request was made to the API at /admin/active_requests |
Y |
Admin |
Query and Index Services |
/admin/indexes/prepareds API request |
28693 |
An HTTP request was made to the API at /admin/indexes/prepareds |
Y |
Admin |
Query and Index Services |
/admin/indexes/active_requests API request |
28694 |
An HTTP request was made to the API at /admin/indexes/active_requests |
Y |
Admin |
Query and Index Services |
/admin/indexes/completed_requests API request |
28695 |
An HTTP request was made to the API at /admin/indexes/completed_requests |
Y |
Admin |
Query and Index Services |
/admin/ping API request |
28697 |
An HTTP request was made to the API at /admin/ping |
Y |
Admin |
Query and Index Services |
/admin/config API request |
28698 |
An HTTP request was made to the API at /admin/config |
Y |
Admin |
Query and Index Services |
/admin/ssl_cert API request |
28699 |
An HTTP request was made to the API at /admin/ssl_cert |
Y |
Admin |
Query and Index Services |
/admin/settings API request |
28700 |
An HTTP request was made to the API at /admin/settings |
Y |
Admin |
Query and Index Services |
/admin/clusters API request |
28701 |
An HTTP request was made to the API at /admin/clusters |
Y |
Admin |
Query and Index Services |
/admin/completed_requests API request |
28702 |
An HTTP request was made to the API at /admin/completed_requests |
Y |
Admin |
Query and Index Services |
N1QL configuration |
28703 |
States that N1QL is using audit configuration with specified uuid |
N |
Admin |
Query and Index Services |
/admin/functions API request |
28704 |
An HTTP request was made to the API at /admin/functions. |
Y |
Admin |
Query and Index Services |
/admin/indexes/functions API request |
28705 |
An HTTP request was made to the API at /admin/indexes/functions. |
Y |
Admin |
Query and Index Services |
CREATE FUNCTION statement |
28706 |
A N1QL CREATE FUNCTION statement was executed |
Y |
Admin |
Query and Index Services |
DROP FUNCTION statement |
28707 |
A N1QL DROP FUNCTION statement was executed |
Y |
Admin |
Query and Index Services |
EXECUTE FUNCTION statement |
28708 |
A N1QL EXECUTE FUNCTION statement was executed |
Y |
Admin |
Query and Index Services |
/admin/tasks API request |
28709 |
An HTTP request was made to the API at /admin/tasks. |
Y |
Admin |
Query and Index Services |
/admin/indexes/tasks API request |
28710 |
An HTTP request was made to the API at /admin/indexes/tasks. |
Y |
Admin |
Query and Index Services |
/admin/dictionary_cache API request |
28711 |
An HTTP request was made to the API at /admin/dictionary_cache |
Y |
Admin |
Query and Index Services |
/admin/indexes/dictionary_cache API request |
28712 |
An HTTP request was made to the API at /admin/indexes/dictionary_cache |
Y |
Admin |
Query and Index Services |
CREATE SCOPE statement |
28713 |
A N1QL CREATE SCOPE statement was executed |
Y |
Admin |
Query and Index Services |
DROP SCOPE statement |
28714 |
A N1QL DROP SCOPE statement was executed |
Y |
Admin |
Query and Index Services |
CREATE COLLECTION statement |
28715 |
A N1QL CREATE COLLECTION statement was executed |
Y |
Admin |
Query and Index Services |
DROP COLLECTION statement |
28716 |
A N1QL DROP COLLECTION statement was executed |
Y |
Admin |
Query and Index Services |
FLUSH COLLECTION statement |
28717 |
A N1QL FLUSH COLLECTION statement was executed |
Y |
Admin |
Query and Index Services |
UPDATE STATISTICS statement |
28718 |
A N1QL UPDATE STATISTICS statement was executed |
Y |
Admin |
Query and Index Services |
ADVISE statement |
28719 |
A N1QL ADVISE statement was executed |
Y |
Admin |
Query and Index Services |
START TRANSACTION statement |
28720 |
A N1QL START TRANSACTION statement was executed |
Y |
Admin |
Query and Index Services |
COMMIT TRANSACTION statement |
28721 |
A N1QL COMMIT TRANSACTION statement was executed |
Y |
Admin |
Query and Index Services |
ROLLBACK TRANSACTION statement |
28722 |
A N1QL ROLLBACK TRANSACTION statement was executed |
Y |
Admin |
Query and Index Services |
ROLLBACK TRANSACTION TO SAVEPOINT statement |
28723 |
A N1QL ROLLBACK TRANSACTION TO SAVEPOINT statement was executed |
Y |
Admin |
Query and Index Services |
SET TRANSACTION ISOLATION statement |
28724 |
A N1QL SET TRANSACTION ISOLATION statement was executed |
Y |
Admin |
Query and Index Services |
SAVEPOINT statement |
28725 |
A N1QL SAVEPOINT statement was executed |
Y |
Admin |
Query and Index Services |
/admin/transactions API request |
28726 |
An HTTP request was made to the API at /admin/transactions. |
Y |
Admin |
Query and Index Services |
/admin/indexes/transactions API request |
28727 |
An HTTP request was made to the API at /admin/indexes/transactions. |
Y |
Admin |
Query and Index Services |
N1QL backup / restore API request |
28728 |
An HTTP request was made to archive or restore N1QL metadata |
Y |
Admin |
Query and Index Services |
/admin/shutdown API request |
28729 |
An HTTP request was made to initate graceful shutdown |
Y |
Admin |
Query and Index Services |
HTTP 401: Unauthorized |
49152 |
Authentication is required to access the requested resource |
N |
Admin |
Query and Index Services |
HTTP 403: Forbidden |
49153 |
The user does not have permission to access the requested resource |
N |
Admin |
Search Service Events
The following events are generated by the Search Service, in response to index and configuration changes, garbage collection, and resource profiling.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Search Service |
Delete index |
24576 |
FTS index was deleted |
N |
Data |
Search Service |
Create/Update index |
24577 |
FTS index was created/Updated |
N |
Data |
Search Service |
Control index |
24579 |
FTS index control command was issued |
N |
Data |
Search Service |
Config refresh |
24580 |
FTS config was refreshed |
N |
Admin |
Search Service |
Config replan |
24581 |
FTS config was replanned |
N |
Admin |
Search Service |
GC run |
24582 |
GC run was triggered |
N |
Admin |
Search Service |
CPU profile |
24583 |
CPU profiling was started |
N |
Admin |
Search Service |
Memory profile |
24584 |
Memory profiling was started |
N |
Admin |
Search Service |
Access denied |
24585 |
User has been denied access due to invalid permissions/credentials |
N |
Admin |
Eventing Service Events
The following events are generated by the Eventing Service, in response to the definition, deployment, and execution of functions; debugging activities; configuration changes; and the importing and exporting of functions.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Eventing Service |
Create Function |
32768 |
Eventing function definition was created or updated |
Y |
Admin |
Eventing Service |
Delete Function |
32769 |
Eventing function definition was deleted |
Y |
Admin |
Eventing Service |
Fetch Functions |
32770 |
Eventing function definition was read |
Y |
Admin |
Eventing Service |
List Deployed |
32771 |
Eventing deployed functions list was read |
Y |
Admin |
Eventing Service |
Fetch Drafts |
32772 |
Eventing function draft definitions were read |
Y |
Admin |
Eventing Service |
Delete Drafts |
32773 |
Eventing function draft definitions were deleted |
Y |
Admin |
Eventing Service |
Save Draft |
32774 |
Save a draft definition to the store |
Y |
Admin |
Eventing Service |
Start Debug |
32775 |
Start eventing function debugger |
Y |
Admin |
Eventing Service |
Stop Debug |
32776 |
Stop eventing function debugger |
Y |
Admin |
Eventing Service |
Start Tracing |
32777 |
Start tracing eventing function execution |
Y |
Admin |
Eventing Service |
Stop Tracing |
32778 |
Stop tracing eventing function execution |
Y |
Admin |
Eventing Service |
Set Settings |
32779 |
Save settings for a given app |
Y |
Admin |
Eventing Service |
Fetch Config |
32780 |
Get config for eventing |
Y |
Admin |
Eventing Service |
Save Config |
32781 |
Save config for eventing |
Y |
Admin |
Eventing Service |
Cleanup Eventing |
32782 |
Clears up app definitions and settings from metakv |
Y |
Admin |
Eventing Service |
Get Settings |
32783 |
Get settings for a given app |
Y |
Admin |
Eventing Service |
Import Functions |
32784 |
Import a list of functions |
Y |
Admin |
Eventing Service |
Export Functions |
32785 |
Export the list of functions |
Y |
Admin |
Eventing Service |
List Running |
32786 |
Eventing running function list was read |
Y |
Admin |
Eventing Service |
Authentication Failure |
32787 |
Authentication failed |
Y |
Admin |
Eventing Service |
Authorization Failure |
32788 |
Authorization failed |
Y |
Admin |
Eventing Service |
Deploy Function |
32789 |
Request to deploy eventing function |
Y |
Admin |
Eventing Service |
Undeploy Function |
32790 |
Request to undeploy eventing function |
Y |
Admin |
Eventing Service |
Pause Function |
32791 |
Request to pause eventing function |
Y |
Admin |
Eventing Service |
Resume Function |
32792 |
Request to resume eventing function |
Y |
Admin |
Eventing Service |
Backup Functions |
32793 |
Request to backup one or more eventing functions |
Y |
Admin |
Eventing Service |
Restore Functions |
32794 |
Request to restore one or more eventing functions |
Y |
Admin |
Eventing Service |
List Function |
32795 |
Request to fetch eventing functions |
Y |
Admin |
Eventing Service |
Function Status |
32796 |
Request to fetch eventing function status |
Y |
Admin |
Eventing Service |
Clear Stats |
32797 |
Request to reset eventing function stats |
Y |
Admin |
Eventing Service |
Fetch Stats |
32798 |
Request to fetch eventing function stats |
Y |
Admin |
Eventing Service |
Eventing Cluster Stats |
32799 |
Request to reset eventing cluster stats |
Y |
Admin |
Eventing Service |
Die |
32800 |
Request to reset eventing process |
Y |
Admin |
Eventing Service |
Eventing System Event |
32801 |
Request to execute eventing node related functions |
Y |
Admin |
Eventing Service |
Get User Info |
32802 |
Request to get user eventing permissions |
Y |
Admin |
Analytics Service Events
The following events are generated by the Analytics Service, in response to configuration changes and statement executions.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Analytics Service |
Service configuration change |
36865 |
A successful service configuration change was made |
Y |
Admin |
Analytics Service |
Node configuration change |
36866 |
A successful node configuration change was made |
Y |
Admin |
Analytics Service |
SELECT statement |
36867 |
A N1QL SELECT statement was executed |
Y |
Data |
Analytics Service |
CREATE DATAVERSE statement |
36868 |
A N1QL CREATE DATAVERSE statement was executed |
Y |
Data |
Analytics Service |
DROP DATAVERSE statement |
36869 |
A N1QL DROP DATAVERSE statement was executed |
Y |
Data |
Analytics Service |
CREATE DATASET statement |
36870 |
A N1QL CREATE DATASET statement was executed |
Y |
Data |
Analytics Service |
DROP DATASET statement |
36871 |
A N1QL DROP DATASET statement was executed |
Y |
Data |
Analytics Service |
CREATE INDEX statement |
36872 |
A N1QL CREATE INDEX statement was executed |
Y |
Data |
Analytics Service |
DROP INDEX statement |
36873 |
A N1QL DROP INDEX statement was executed |
Y |
Data |
Analytics Service |
CONNECT LINK statement |
36877 |
A N1QL CONNECT LINK statement was executed |
Y |
Data |
Analytics Service |
DISCONNECT LINK statement |
36878 |
A N1QL DISCONNECT LINK statement was executed |
Y |
Data |
Analytics Service |
UNRECOGNIZED statement |
36879 |
An UNRECOGNIZED N1QL statement was encountered |
Y |
Admin |
Analytics Service |
ALTER COLLECTION statement |
36880 |
A N1QL ALTER COLLECTION statement was executed |
Y |
Data |
Backup Service Events
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Backup Service |
Modify configuration |
45056 |
Backup service configuration was modified |
Y |
Admin |
Backup Service |
Fetch configuration |
45057 |
Backup service configuration was retrieved |
Y |
Admin |
Backup Service |
Add plan |
45058 |
A new backup plan was added |
Y |
Admin |
Backup Service |
Modify plan |
45059 |
Existing backup plan was modified |
Y |
Admin |
Backup Service |
Delete plan |
45060 |
A backup plan was removed |
Y |
Admin |
Backup Service |
Fetch plan |
45061 |
One or more backup plans were fetched |
Y |
Admin |
Backup Service |
Add repository |
45062 |
A new active backup repository was added |
Y |
Admin |
Backup Service |
Archive repository |
45063 |
An active repository was archived |
Y |
Admin |
Backup Service |
Pause repository |
45064 |
An active repository was paused |
Y |
Admin |
Backup Service |
Resume repository |
45065 |
An active repository was resumed |
Y |
Admin |
Backup Service |
Fetch repository |
45066 |
A repository was fetched |
Y |
Admin |
Backup Service |
Restore repository |
45067 |
The repository data was restored |
Y |
Admin |
Backup Service |
Backup repository |
45068 |
A manual backup was triggered on an active repository |
Y |
Admin |
Backup Service |
Merge repository |
45069 |
A manual merge was triggered on an active repository |
Y |
Admin |
Backup Service |
Info repository |
45070 |
Information about the structure and contents of the backup repository was fetched |
Y |
Admin |
Backup Service |
Examine repository |
45071 |
A document was retrieved from the repository backups |
Y |
Admin |
Backup Service |
Delete repository |
45072 |
A repository was deleted |
Y |
Admin |
Backup Service |
Delete backup |
45073 |
An active repository backup was deleted |
Y |
Admin |
Backup Service |
Access denied |
45074 |
A user has been denied access to the REST API due to invalid permissions or credentials |
Y |
Admin |
View Engine Events
The following events are generated by the View Engine.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
View Engine |
Create Design Doc |
40960 |
Design Doc is Created |
Y |
Data |
View Engine |
Delete Design Doc |
40961 |
Design Doc is Deleted |
Y |
Data |
View Engine |
Query DDoc Meta Data |
40962 |
Design Doc Meta Data Query Request |
Y |
Data |
View Engine |
View Query |
40963 |
View Query Request |
Y |
Data |
View Engine |
Update Design Doc |
40964 |
Design Doc is Updated |
Y |
Data |
View Engine |
Audit Configuration change |
40965 |
Change in Audit Configuration |
N |
Admin |
View Engine |
Access denied |
40966 |
Access denied to the REST API due to invalid permissions or credentials |
Y |
Admin |
Audit Events
The following events are generated by the audit daemon itself.
| Event Group | Event Name | ID | Description | Filter? | Event Type |
|---|---|---|---|---|---|
Audit |
configured audit daemon |
4096 |
Loaded configuration file for audit daemon |
N |
Admin |
Audit |
shutting down audit daemon |
4097 |
The audit daemon is being shut down |
N |
Admin |