Audit logging basics in MongoDB - Mini Project: Build & Apply

Audit logging basics

📖 Scenario: You are a database administrator setting up audit logging in MongoDB to track important actions for security and compliance.

🎯 Goal: Learn how to enable audit logging in MongoDB by creating the initial audit configuration, setting audit filters, and verifying audit logs.

📋 What You'll Learn

Create an audit configuration file with specific settings

Add a filter to log only authentication events

Enable audit logging in MongoDB using the configuration file

Verify audit logs contain expected entries

💡 Why This Matters

🌍 Real World

Audit logging helps track who accessed or changed data in MongoDB, which is important for security and compliance in real companies.

💼 Career

Database administrators and DevOps engineers use audit logging to monitor database activity and meet regulatory requirements.

1

Create audit configuration file

Create a file named auditConfig.json with the following JSON content exactly: {"auditLog": {"destination": "file", "format": "JSON", "path": "/var/log/mongodb/auditLog.json"}}

MongoDB

# Create the file auditConfig.json with the exact JSON content
# Your code here

Hint

Use a text editor to create auditConfig.json with the exact JSON structure shown.

2

Add audit filter for authentication events

Add a new key filter inside auditLog in auditConfig.json with the value {"atype": {"$in": ["authCheck", "authenticate"]}} to log only authentication events.

MongoDB

{"auditLog": {"destination": "file", "format": "JSON", "path": "/var/log/mongodb/auditLog.json"}}
# Add the filter key inside auditLog to log only authCheck and authenticate events
# Your code here

Hint

Insert the filter key inside the auditLog object with the exact JSON filter value.

3

Enable audit logging in MongoDB

Start MongoDB with the audit configuration file by running the command mongod --auditDestination file --auditFormat JSON --auditPath /var/log/mongodb/auditLog.json --auditFilter '{"atype": {"$in": ["authCheck", "authenticate"]}}' in the terminal.

MongoDB

{"auditLog": {"destination": "file", "format": "JSON", "path": "/var/log/mongodb/auditLog.json", "filter": {"atype": {"$in": ["authCheck", "authenticate"]}}}}
# Run the mongod command below to start MongoDB with audit logging enabled
# Your code here

Hint

Use the mongod command with the exact flags and values to enable audit logging.

4

Verify audit log entries

Run cat /var/log/mongodb/auditLog.json in the terminal to display the audit log file contents and confirm it contains entries with "atype": "authCheck" or "atype": "authenticate".

MongoDB

{"auditLog": {"destination": "file", "format": "JSON", "path": "/var/log/mongodb/auditLog.json", "filter": {"atype": {"$in": ["authCheck", "authenticate"]}}}}
mongod --auditDestination file --auditFormat JSON --auditPath /var/log/mongodb/auditLog.json --auditFilter '{"atype": {"$in": ["authCheck", "authenticate"]}}'
# Run the command below to display the audit log contents
# Your code here

Hint

Use cat to read the audit log file and check for authentication event entries.

Practice

1. What is the main purpose of audit logging in MongoDB?

easy

A. To improve database query speed

B. To record database actions for security and troubleshooting

C. To backup data automatically

D. To monitor server hardware health

Solution

1. Step 1: Understand audit logging function

   Audit logging captures actions performed on the database to help track security events and troubleshoot issues.

2. Step 2: Compare options

   Options B, C, and D describe unrelated functions like speed, backup, or hardware monitoring, which are not audit logging purposes.

3. Final Answer:

   To record database actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security, not performance [OK]

Common Mistakes:

• Confusing audit logging with backup
• Thinking audit logs improve query speed
• Mixing audit logs with hardware monitoring

2. Which configuration file is used to enable audit logging in MongoDB?

easy

A. mongod.conf

B. mongo.cfg

C. audit.log

D. db.config

Solution

1. Step 1: Identify MongoDB config file

   MongoDB uses mongod.conf to configure server settings including audit logging.

2. Step 2: Eliminate incorrect options

   Files like mongo.cfg, audit.log, and db.config are not standard MongoDB config files.

3. Final Answer:

   mongod.conf -> Option A

4. Quick Check:

   Audit logging config = mongod.conf [OK]

Hint: MongoDB server settings are in mongod.conf [OK]

Common Mistakes:

• Confusing log file with config file
• Using wrong file extensions
• Assuming audit.log is a config file

3. Given this snippet in mongod.conf:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: { $in: ["authCheck", "createUser"] } }'

What events will be logged?

medium

A. No events will be logged due to syntax error

B. All database events

C. Only user deletion events

D. Only authentication checks and user creation events

Solution

1. Step 1: Analyze the filter field

   The filter uses atype with $in to include only "authCheck" and "createUser" event types.

2. Step 2: Understand event selection

   Only events matching these types will be logged, excluding others like user deletion or all events.

3. Final Answer:

   Only authentication checks and user creation events -> Option D

4. Quick Check:

   Filter limits events = authCheck, createUser [OK]

Hint: Filter with $in selects listed event types only [OK]

Common Mistakes:

• Assuming all events are logged
• Confusing createUser with deleteUser
• Thinking syntax error disables logging

4. You added this to mongod.conf but audit logs are not created:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: "authCheck" }'

What is the likely problem?

medium

A. Audit logging requires restart of mongod service

B. The path is invalid and MongoDB cannot write logs

C. Filter syntax is incorrect; it should use $in operator

D. Format JSON is not supported for audit logs

Solution

1. Step 1: Check configuration correctness

   The filter syntax is valid for a single event type; JSON format and path are correct.

2. Step 2: Consider service restart requirement

   Changes in mongod.conf require restarting the mongod service to apply new audit logging settings.

3. Final Answer:

   Audit logging requires restart of mongod service -> Option A

4. Quick Check:

   Config changes need restart [OK]

Hint: Restart mongod after config changes to enable audit logging [OK]

Common Mistakes:

• Assuming filter syntax error without checking
• Ignoring need to restart mongod
• Thinking JSON format is unsupported

5. You want to log all user management events except dropUser. Which filter correctly achieves this in mongod.conf?

hard

A. filter: '{ atype: { $in: ["createUser", "updateUser"] } }'

B. filter: '{ atype: { $eq: "dropUser" } }'

C. filter: '{ atype: { $nin: ["dropUser"] } }'

D. filter: '{ atype: "dropUser" }'

Solution

1. Step 1: Understand $nin operator

   The $nin operator excludes specified values, so { $nin: ["dropUser"] } excludes dropUser events.

2. Step 2: Check other options

   filter: '{ atype: { $in: ["createUser", "updateUser"] } }' logs only createUser and updateUser, missing other user events. Options B and C log only dropUser events, opposite of requirement.

3. Final Answer:

   filter: '{ atype: { $nin: ["dropUser"] } }' -> Option C

4. Quick Check:

   Exclude dropUser with $nin [OK]

Hint: Use $nin to exclude specific event types from audit logs [OK]

Common Mistakes:

• Using $in instead of $nin to exclude events
• Selecting only some user events instead of excluding one
• Confusing $eq with exclusion