From 71752fbec21c4bb60871b10f0b37bafb21b5cb52 Mon Sep 17 00:00:00 2001 From: Ray Offiah Date: Fri, 9 May 2025 08:41:08 +0100 Subject: [PATCH 1/2] [DOC-12746]: We need to add note to the current documentation to let customers know how audit log records events. --- modules/learn/pages/security/auditing.adoc | 3 +++ modules/learn/partials/user-audit-warning.adoc | 9 +++++++++ 2 files changed, 12 insertions(+) create mode 100644 modules/learn/partials/user-audit-warning.adoc diff --git a/modules/learn/pages/security/auditing.adoc b/modules/learn/pages/security/auditing.adoc index 6297205df2..3ebed9a7fd 100644 --- a/modules/learn/pages/security/auditing.adoc +++ b/modules/learn/pages/security/auditing.adoc @@ -55,6 +55,9 @@ For example, `"Unsuccessful attempt to login to couchbase cluster"`, `"Node was | Object | Contains key-value pairs for `"domain"` (specifying `"local"`; `"external"`; `"builtin"` — for the administrator who set up the cluster; or `"rejected"` — for a user who has been denied access); and `"user"` (specifying the id of the user who generated the event). +3+a| +include::partial$user-audit-warning.adoc[] + | `"local"` | Object | Contains key-value pairs for `"ip"` and incoming `"port"`, for the node on which the event was processed. diff --git a/modules/learn/partials/user-audit-warning.adoc b/modules/learn/partials/user-audit-warning.adoc new file mode 100644 index 0000000000..284b86f1f5 --- /dev/null +++ b/modules/learn/partials/user-audit-warning.adoc @@ -0,0 +1,9 @@ +[IMPORTANT] +.The occurrence of a system id in the audit log. +==== +In some instances, +the server will carry out an audited function +using a system identifier for the `user` field instead of the actual user logged into the system. + +This may show up in the audit logs as `"user":"@ns_server"` for example. +==== \ No newline at end of file From 8005f14c0f3f5e409979cdbd76352c9f86482c51 Mon Sep 17 00:00:00 2001 From: Ray Offiah Date: Fri, 9 May 2025 09:01:35 +0100 Subject: [PATCH 2/2] [DOC-12746]: We need to add note to the current documentation to let customers know how audit log records events. Adding preview. --- preview/HEAD.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/preview/HEAD.yml b/preview/HEAD.yml index 1523eff7ed..91179ba180 100644 --- a/preview/HEAD.yml +++ b/preview/HEAD.yml @@ -1,4 +1,6 @@ sources: docs-devex: branches: release/7.6 + docs-capella: + branches: DOC-12746-We-need-to-add-info-to-the-current-documentation-to-let-customers-know-how-audit-log-records-events