Details
-
Bug
-
Resolution: Duplicate
-
Major
-
5.5.0
-
None
-
Untriaged
-
Centos 64-bit
-
-
Yes
Description
Build 5.5.0-2010.
Setup:
- 4 kv nodes, 1 query node
- 1 bucket
- Q1 benchmark
All N1QL events are enabled:
> curl -s http://Administrator:password@172.23.100.55:8091/settings/audit | jq '.'
|
{
|
"disabled": [
|
20485,
|
20488,
|
20489,
|
20490,
|
20491,
|
32770,
|
32771,
|
32772,
|
32780
|
],
|
"uid": "16318696",
|
"auditdEnabled": true,
|
"disabledUsers": [],
|
"logPath": "/opt/couchbase/var/lib/couchbase/logs",
|
"rotateInterval": 86400,
|
"rotateSize": 20971520
|
}
|
Query engine received the new configuration:
_time=2018-02-28T16:30:43.533-08:00 _level=INFO _msg=Audit update handler function 1: Got updated audit settings: {AuditEnabled:true EventDisabled:map[20488:true 20489:true 20491:true 32772:true 20485:true 20490:true 32770:true 32771:true 32780:true] UserWhitelisted:map[] Uid:16318696}
|
17% drop in throughput and results of CPU profiling indicate that auditing does take place. However, the audit log is empty:
{
|
"timestamp": "2018-02-28T16:29:56.638904-08:00",
|
"real_userid": {
|
"source": "internal",
|
"user": "couchbase"
|
},
|
"auditd_enabled": true,
|
"descriptors_path": "/opt/couchbase/etc/security",
|
"hostname": "172-23-100-55",
|
"log_path": "/opt/couchbase/var/lib/couchbase/logs",
|
"rotate_interval": 86400,
|
"version": 2,
|
"uuid": "121393565",
|
"id": 4096,
|
"name": "configured audit daemon",
|
"description": "loaded configuration file for audit daemon"
|
}
|
{
|
"timestamp": "2018-02-28T16:29:56.804-08:00",
|
"real_userid": {
|
"source": "",
|
"user": ""
|
},
|
"uuid": "121393565",
|
"id": 28703,
|
"name": "N1QL configuration",
|
"description": "States that N1QL is using audit configuration with specified uuid"
|
}
|
{
|
"roles": [
|
"admin"
|
],
|
"real_userid": {
|
"source": "ns_server",
|
"user": "Administrator"
|
},
|
"sessionid": "51418fe6ac842a247283ef6b242eccfa",
|
"remote": {
|
"ip": "10.17.5.113",
|
"port": 46200
|
},
|
"timestamp": "2018-02-28T16:30:32.095-08:00",
|
"id": 8192,
|
"name": "login success",
|
"description": "Successful login to couchbase cluster"
|
}
|
{
|
"timestamp": "2018-02-28T16:30:43.464298-08:00",
|
"real_userid": {
|
"source": "internal",
|
"user": "couchbase"
|
},
|
"auditd_enabled": true,
|
"descriptors_path": "/opt/couchbase/etc/security",
|
"hostname": "172-23-100-55",
|
"log_path": "/opt/couchbase/var/lib/couchbase/logs",
|
"rotate_interval": 86400,
|
"version": 2,
|
"uuid": "16318696",
|
"id": 4096,
|
"name": "configured audit daemon",
|
"description": "loaded configuration file for audit daemon"
|
}
|
{
|
"timestamp": "2018-02-28T16:30:43.533-08:00",
|
"real_userid": {
|
"source": "",
|
"user": ""
|
},
|
"uuid": "16318696",
|
"id": 28703,
|
"name": "N1QL configuration",
|
"description": "States that N1QL is using audit configuration with specified uuid"
|
}
|
Probably a duplicate of MB-28271.
Attachments
Issue Links
- duplicates
-
-
- Closed
-