Audit logging basics in MongoDB

Introduction

Audit logging helps you keep track of what happens in your database. It records actions so you can check who did what and when.

You want to see who accessed or changed data in your MongoDB database.

You need to follow security rules that require tracking user actions.

You want to find out what caused a problem by reviewing past events.

You want to monitor database activity for unusual or suspicious behavior.

Syntax

MongoDB

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/auditLog.json
  filter: '{ atype: { $in: ["authCheck", "createCollection"] } }'

The auditLog settings go inside the MongoDB configuration file (mongod.conf).

You can choose where to save logs and what events to record using filters.

Examples

This example saves all audit logs as JSON to a file.

MongoDB

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/auditLog.json

This example saves audit logs in BSON format, which is MongoDB's binary format.

MongoDB

auditLog:
  destination: file
  format: BSON
  path: /var/log/mongodb/auditLog.bson

This example records only authentication check events.

MongoDB

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/auditLog.json
  filter: '{ atype: "authCheck" }'

Sample Program

This configuration enables audit logging to a JSON file. It records only authentication checks and collection creation events.

MongoDB

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/auditLog.json
  filter: '{ atype: { $in: ["authCheck", "createCollection"] } }'

Important Notes

Audit logging can slow down your database if you log too many events.

Make sure the log file path is writable by the MongoDB process.

Use filters to limit logs to important events and save disk space.

Summary

Audit logging records database actions for security and troubleshooting.

Configure auditLog in mongod.conf to enable and customize logging.

Use filters to control which events get logged.