Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-28300

Only important admin events should be audited by default

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 5.5.0
    • 5.5.0
    • query
    • Untriaged
    • No

    Description

      This is what our web UI says about auditing:

      Auditing keeps track of important admin events occurring in Couchbase.

      That was true in Spock when only a few events were logged.

      If audit was enabled in 5.0 cluster, then all N1QL events will be enabled upon upgrade to 5.5:

      > curl -s http://Administrator:password@172.23.133.13:8091/settings/audit | jq '.'
      {
        "disabled": [
          20485,
          20488,
          20489,
          20490,
          20491
        ],
        "uid": "121393565",
        "auditdEnabled": true,
        "disabledUsers": [],
        "logPath": "/opt/couchbase/var/lib/couchbase/logs",
        "rotateInterval": 86400,
        "rotateSize": 20971520
      }
      

      Certain memcached events are disabled by default and that is the right behavior. All N1QL events are enabled though.

      New deployments will be affected as well unless users/customers opt out.

      MB-28274 and MB-28276 explain why SELECT and UPDATE statements probably should not be audited by default.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              rob.ashcom Rob Ashcom (Inactive)
              pavelpaulau Pavel Paulau (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty