Working with Auditing
1. Enabling Audit Log
auditLog:
destination: file
format: JSON
path: /var/log/mongodb/audit.json2. Configuring Audit Filters
| Form | Detail |
|---|---|
| auditLog.filter | BSON predicate on audit events |
| runtimeConfiguration | setAuditConfig command |
3. Auditing Authentication Events
| Action | Detail |
|---|---|
| authenticate | Login attempts |
| logout | Disconnection |
| authCheck | Privilege checks (verbose) |
4. Auditing Authorization Events
| Action | Detail |
|---|---|
| createUser / dropUser | User lifecycle |
| grantRolesToUser / revoke | Privilege changes |
5. Auditing DDL Operations
| Action | Detail |
|---|---|
| createCollection / dropCollection | Schema lifecycle |
| createIndex / dropIndex | Indexes |
| dropDatabase | DB removal |
6. Auditing DML Operations
| Aspect | Detail |
|---|---|
| Enable | filter on {atype:"authCheck", "param.command":"insert"} |
| Caution | Volume can be huge |
7. Auditing Administrative Actions
| Action | Detail |
|---|---|
| replSetReconfig | Replica set topology changes |
| shutdown | Server shutdowns |
| setParameter | Runtime config changes |
8. Using Audit Log File
| Destination | Detail |
|---|---|
| file | JSON or BSON output |
| syslog | OS syslog |
| console | Stdout |
9. Understanding Audit Event Structure
| Field | Detail |
|---|---|
| atype | Action type |
| ts | Timestamp |
| users | Acting principals |
| roles | Active roles |
| param | Action-specific args |
| result | 0 = success |
10. Analyzing Audit Logs
| Tool | Use |
|---|---|
| jq | Filter JSON events on CLI |
| SIEM | Forward to Splunk / Elastic |
| Atlas | Built-in audit log viewer |