Audit logging basics in MongoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

MongoDB Audit Log Enablement Command Output

You run the following command to enable audit logging in MongoDB:

db.adminCommand({ setParameter: 1, auditAuthorizationSuccess: true })

What is the expected output of this command?

MongoDB

db.adminCommand({ setParameter: 1, auditAuthorizationSuccess: true })

A { "ok" : 1, "auditAuthorizationSuccess" : true }

B { "ok" : 0, "errmsg" : "Invalid parameter" }

C { "ok" : 1 }

D SyntaxError: Unexpected token

💡 Hint

The command returns a simple status object indicating success or failure.

The setParameter admin command returns { "ok" : 1 } on success without echoing the parameter value.

🧠 Conceptual

intermediate

Purpose of MongoDB Audit Logging

What is the primary purpose of enabling audit logging in MongoDB?

A To record detailed information about database operations for security and compliance

B To encrypt data stored in the database

C To automatically backup the database at regular intervals

D To improve database query performance by caching results

💡 Hint

Think about why organizations track user actions and system events.

Audit logging records who did what and when in the database, helping with security audits and compliance.

❓ Configuration

advanced

Correct Audit Log Configuration in mongod.conf

Which of the following is the correct snippet to enable audit logging in the mongod.conf file with JSON format and output to a file named audit.log?

A

auditLog:
  destination: file
  format: JSON
  filePath: /var/log/mongodb/audit.log

B

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.log

C

auditLog:
  destination: syslog
  format: BSON
  path: /var/log/mongodb/audit.log

D

auditLog:
  destination: file
  format: BSON
  path: /var/log/mongodb/audit.log

💡 Hint

Check the exact keys and values required by MongoDB for auditLog configuration.

The correct keys are destination, format, and path. The format must be JSON or BSON. The path key specifies the file location.

❓ Troubleshoot

advanced

Audit Log Not Created After Configuration

After configuring audit logging in mongod.conf and restarting MongoDB, no audit log file is created. Which is the most likely cause?

A The mongod.conf file syntax is invalid and MongoDB failed to start

B Audit logging is disabled by default and cannot be enabled

C The audit log format is set to XML which MongoDB does not support

D The MongoDB user does not have write permission to the audit log directory

💡 Hint

Think about file system permissions and user rights.

If MongoDB cannot write to the specified directory due to permissions, the audit log file won't be created.

✅ Best Practice

expert

Best Practice for Managing MongoDB Audit Logs in Production

Which of the following is the best practice for managing MongoDB audit logs in a production environment?

A Rotate audit logs regularly and store them securely with restricted access

B Keep audit logs indefinitely on the same disk without rotation

C Disable audit logging during peak hours to improve performance

D Store audit logs in the same directory as the database data files

💡 Hint

Consider security and disk space management.

Regular rotation prevents disk space issues and storing logs securely protects sensitive audit data.

Practice

1. What is the main purpose of audit logging in MongoDB?

easy

A. To improve database query speed

B. To record database actions for security and troubleshooting

C. To backup data automatically

D. To monitor server hardware health

Solution

1. Step 1: Understand audit logging function

   Audit logging captures actions performed on the database to help track security events and troubleshoot issues.

2. Step 2: Compare options

   Options B, C, and D describe unrelated functions like speed, backup, or hardware monitoring, which are not audit logging purposes.

3. Final Answer:

   To record database actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security, not performance [OK]

Common Mistakes:

• Confusing audit logging with backup
• Thinking audit logs improve query speed
• Mixing audit logs with hardware monitoring

2. Which configuration file is used to enable audit logging in MongoDB?

easy

A. mongod.conf

B. mongo.cfg

C. audit.log

D. db.config

Solution

1. Step 1: Identify MongoDB config file

   MongoDB uses mongod.conf to configure server settings including audit logging.

2. Step 2: Eliminate incorrect options

   Files like mongo.cfg, audit.log, and db.config are not standard MongoDB config files.

3. Final Answer:

   mongod.conf -> Option A

4. Quick Check:

   Audit logging config = mongod.conf [OK]

Hint: MongoDB server settings are in mongod.conf [OK]

Common Mistakes:

• Confusing log file with config file
• Using wrong file extensions
• Assuming audit.log is a config file

3. Given this snippet in mongod.conf:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: { $in: ["authCheck", "createUser"] } }'

What events will be logged?

medium

A. No events will be logged due to syntax error

B. All database events

C. Only user deletion events

D. Only authentication checks and user creation events

Solution

1. Step 1: Analyze the filter field

   The filter uses atype with $in to include only "authCheck" and "createUser" event types.

2. Step 2: Understand event selection

   Only events matching these types will be logged, excluding others like user deletion or all events.

3. Final Answer:

   Only authentication checks and user creation events -> Option D

4. Quick Check:

   Filter limits events = authCheck, createUser [OK]

Hint: Filter with $in selects listed event types only [OK]

Common Mistakes:

• Assuming all events are logged
• Confusing createUser with deleteUser
• Thinking syntax error disables logging

4. You added this to mongod.conf but audit logs are not created:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: "authCheck" }'

What is the likely problem?

medium

A. Audit logging requires restart of mongod service

B. The path is invalid and MongoDB cannot write logs

C. Filter syntax is incorrect; it should use $in operator

D. Format JSON is not supported for audit logs

Solution

1. Step 1: Check configuration correctness

   The filter syntax is valid for a single event type; JSON format and path are correct.

2. Step 2: Consider service restart requirement

   Changes in mongod.conf require restarting the mongod service to apply new audit logging settings.

3. Final Answer:

   Audit logging requires restart of mongod service -> Option A

4. Quick Check:

   Config changes need restart [OK]

Hint: Restart mongod after config changes to enable audit logging [OK]

Common Mistakes:

• Assuming filter syntax error without checking
• Ignoring need to restart mongod
• Thinking JSON format is unsupported

5. You want to log all user management events except dropUser. Which filter correctly achieves this in mongod.conf?

hard

A. filter: '{ atype: { $in: ["createUser", "updateUser"] } }'

B. filter: '{ atype: { $eq: "dropUser" } }'

C. filter: '{ atype: { $nin: ["dropUser"] } }'

D. filter: '{ atype: "dropUser" }'

Solution

1. Step 1: Understand $nin operator

   The $nin operator excludes specified values, so { $nin: ["dropUser"] } excludes dropUser events.

2. Step 2: Check other options

   filter: '{ atype: { $in: ["createUser", "updateUser"] } }' logs only createUser and updateUser, missing other user events. Options B and C log only dropUser events, opposite of requirement.

3. Final Answer:

   filter: '{ atype: { $nin: ["dropUser"] } }' -> Option C

4. Quick Check:

   Exclude dropUser with $nin [OK]

Hint: Use $nin to exclude specific event types from audit logs [OK]

Common Mistakes:

• Using $in instead of $nin to exclude events
• Selecting only some user events instead of excluding one
• Confusing $eq with exclusion