Audit logging basics in MongoDB - Time & Space Complexity

Time Complexity: Audit logging basics

O(n)

Understanding Time Complexity

Audit logging in MongoDB records actions on the database for security and tracking.

We want to understand how the time to log each action changes as more actions happen.

Scenario Under Consideration

Analyze the time complexity of this audit logging setup.

    db.createCollection("auditLog")
    
    function logAction(action) {
      db.auditLog.insertOne({
        timestamp: new Date(),
        action: action
      })
    }
    
    // Example usage
    logAction("user_login")
    

This code creates an audit log collection and inserts a log entry for each action.

Identify Repeating Operations

Look at what repeats when logging many actions.

• Primary operation: Inserting one document into the auditLog collection.
• How many times: Once per action logged, so as many times as actions happen.

How Execution Grows With Input

Each new action causes one insert operation.

Input Size (n)	Approx. Operations
10	10 insert operations
100	100 insert operations
1000	1000 insert operations

Pattern observation: The number of operations grows directly with the number of actions logged.

Final Time Complexity

Time Complexity: O(n)

This means the time to log actions grows linearly with how many actions you record.

Common Mistake

[X] Wrong: "Logging many actions happens instantly and does not slow down."

[OK] Correct: Each log entry requires a database insert, so more actions mean more inserts and more time.

Interview Connect

Understanding how logging scales helps you design systems that keep track of activity without slowing down.

Self-Check

"What if we batch multiple log entries into one insert? How would the time complexity change?"

Practice

1. What is the main purpose of audit logging in MongoDB?

easy

A. To improve database query speed

B. To record database actions for security and troubleshooting

C. To backup data automatically

D. To monitor server hardware health

Solution

1. Step 1: Understand audit logging function

   Audit logging captures actions performed on the database to help track security events and troubleshoot issues.

2. Step 2: Compare options

   Options B, C, and D describe unrelated functions like speed, backup, or hardware monitoring, which are not audit logging purposes.

3. Final Answer:

   To record database actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security, not performance [OK]

Common Mistakes:

• Confusing audit logging with backup
• Thinking audit logs improve query speed
• Mixing audit logs with hardware monitoring

2. Which configuration file is used to enable audit logging in MongoDB?

easy

A. mongod.conf

B. mongo.cfg

C. audit.log

D. db.config

Solution

1. Step 1: Identify MongoDB config file

   MongoDB uses mongod.conf to configure server settings including audit logging.

2. Step 2: Eliminate incorrect options

   Files like mongo.cfg, audit.log, and db.config are not standard MongoDB config files.

3. Final Answer:

   mongod.conf -> Option A

4. Quick Check:

   Audit logging config = mongod.conf [OK]

Hint: MongoDB server settings are in mongod.conf [OK]

Common Mistakes:

• Confusing log file with config file
• Using wrong file extensions
• Assuming audit.log is a config file

3. Given this snippet in mongod.conf:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: { $in: ["authCheck", "createUser"] } }'

What events will be logged?

medium

A. No events will be logged due to syntax error

B. All database events

C. Only user deletion events

D. Only authentication checks and user creation events

Solution

1. Step 1: Analyze the filter field

   The filter uses atype with $in to include only "authCheck" and "createUser" event types.

2. Step 2: Understand event selection

   Only events matching these types will be logged, excluding others like user deletion or all events.

3. Final Answer:

   Only authentication checks and user creation events -> Option D

4. Quick Check:

   Filter limits events = authCheck, createUser [OK]

Hint: Filter with $in selects listed event types only [OK]

Common Mistakes:

• Assuming all events are logged
• Confusing createUser with deleteUser
• Thinking syntax error disables logging

4. You added this to mongod.conf but audit logs are not created:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: "authCheck" }'

What is the likely problem?

medium

A. Audit logging requires restart of mongod service

B. The path is invalid and MongoDB cannot write logs

C. Filter syntax is incorrect; it should use $in operator

D. Format JSON is not supported for audit logs

Solution

1. Step 1: Check configuration correctness

   The filter syntax is valid for a single event type; JSON format and path are correct.

2. Step 2: Consider service restart requirement

   Changes in mongod.conf require restarting the mongod service to apply new audit logging settings.

3. Final Answer:

   Audit logging requires restart of mongod service -> Option A

4. Quick Check:

   Config changes need restart [OK]

Hint: Restart mongod after config changes to enable audit logging [OK]

Common Mistakes:

• Assuming filter syntax error without checking
• Ignoring need to restart mongod
• Thinking JSON format is unsupported

5. You want to log all user management events except dropUser. Which filter correctly achieves this in mongod.conf?

hard

A. filter: '{ atype: { $in: ["createUser", "updateUser"] } }'

B. filter: '{ atype: { $eq: "dropUser" } }'

C. filter: '{ atype: { $nin: ["dropUser"] } }'

D. filter: '{ atype: "dropUser" }'

Solution

1. Step 1: Understand $nin operator

   The $nin operator excludes specified values, so { $nin: ["dropUser"] } excludes dropUser events.

2. Step 2: Check other options

   filter: '{ atype: { $in: ["createUser", "updateUser"] } }' logs only createUser and updateUser, missing other user events. Options B and C log only dropUser events, opposite of requirement.

3. Final Answer:

   filter: '{ atype: { $nin: ["dropUser"] } }' -> Option C

4. Quick Check:

   Exclude dropUser with $nin [OK]

Hint: Use $nin to exclude specific event types from audit logs [OK]

Common Mistakes:

• Using $in instead of $nin to exclude events
• Selecting only some user events instead of excluding one
• Confusing $eq with exclusion