1

My app is using Couchbase Community Edition and due to the limit on the number of buckets multiple apps are sharing the same bucket. The apps are all using their own app specific key prefixes.

It looks like one of the apps is misbehaving and deletes documents which are not associated with its key prefix. Is there a way to query the logs to have a document deletion audit log I can use to notice deletions?

For troubleshooting I would need the deleted key and maybe the ip. Getting the deleted key would be enough to justify my app getting its own bucket.

Community
  • 1
  • 1
Jeno Laszlo
  • 2,023
  • 18
  • 36

1 Answers1

0

You can use a Couchbase Database Change Protocol (DCP) client to monitor deletions. See java-dcp-client for an example client that will log messages for deletions and mutations.

Mutation: MutationMessage [key: "test123", vbid: 20, cas: 1502245791579701248, 
    bySeqno: 1, revSeqno: 1, flags: 0, expiry: 0, lockTime: 0, 
    clength: 67]
Deletion: DeletionMessage [key: "test123", vbid: 20, cas: 1502245805446594560, 
    bySeqno: 2, revSeqno: 2]

Check the expiry on the newly created document to see if you're inadvertently setting the document's time-to-live.

If deletions are performed using the REST endpoint on port 8091, they will be reported in the http_access.log file. See Using Logs (4.5) for information on where to find the log file in your environment. That will also give you the IP address of the machine making the request.

http_access.log:127.0.0.1 - ui-token [08/Aug/2017:22:30:05 -0400] 
    "DELETE /pools/default/buckets/default/docs/test123 HTTP/1.1" 200 2 
    http://localhost:8091/ui/index.html Mozilla/5.0 (Macintosh; Intel Mac
    OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) 
    Chrome/59.0.3071.115 Safari/537.36
Jeff Kurtz
  • 651
  • 4
  • 8
  • hi Jeff. Thanks for the response. We do client side logging but not all clients are using the same lib and some of them don't have this capability. The http logs will have info about the API calls like the cluster, node, bucket, view, cdcr, compaction and user api. I don't think CB has an api for documents (it was a separated project for a while and I think it was discontinued). In any case it is not used in my case. – Jeno Laszlo Aug 10 '17 at 04:45
  • Hi @JenoLaszlo. The DCP client I mentioned would talk directly to the cluster, so you would at least know when the documents were being deleted. But I guess you'd have to be able to run the applications in isolation, otherwise you couldn't tell which client app was responsible for the deletion. – Jeff Kurtz Aug 10 '17 at 11:12