Audit logging basics in MongoDB - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is audit logging in MongoDB?

Audit logging in MongoDB records detailed information about database operations for security and compliance purposes.

beginner

Which MongoDB configuration file section enables audit logging?

The auditLog section in the MongoDB configuration file enables audit logging.

beginner

Name one common format used for MongoDB audit logs.

MongoDB audit logs are commonly stored in JSON format for easy parsing and analysis.

intermediate

What kind of events can MongoDB audit logging capture?

MongoDB audit logging can capture events like authentication attempts, user actions, and changes to data or configuration.

intermediate

How do you specify the destination for audit logs in MongoDB?

You specify the destination using the destination field in the auditLog configuration, such as file or syslog.

What is the main purpose of audit logging in MongoDB?

A To monitor server hardware

B To improve query performance

C To backup data automatically

D To track database operations for security and compliance

Audit logging records database operations to help with security and compliance monitoring.

Which configuration section enables audit logging in MongoDB?

A auditLog

B security

C network

D storage

The auditLog section in the config file is used to enable and configure audit logging.

In which format are MongoDB audit logs usually stored?

A CSV

B JSON

C XML

D YAML

MongoDB audit logs are typically stored in JSON format for easy reading and processing.

Which of these is NOT typically recorded by MongoDB audit logs?

A Network traffic details

B Data changes

C User authentication attempts

D Configuration changes

Audit logs focus on database events, not detailed network traffic.

How do you specify where audit logs are saved in MongoDB?

A Using the storageEngine setting

B Using the logPath field in network config

C Using the destination field in auditLog config

D Using the backupPath setting

The destination field inside auditLog config defines where audit logs are saved, like a file or syslog.

Explain what audit logging is in MongoDB and why it is important.

Think about how keeping records helps protect and monitor your database.

Describe how to enable and configure audit logging in MongoDB.

Focus on the config file changes needed to start audit logging.

Practice

1. What is the main purpose of audit logging in MongoDB?

easy

A. To improve database query speed

B. To record database actions for security and troubleshooting

C. To backup data automatically

D. To monitor server hardware health

Solution

1. Step 1: Understand audit logging function

   Audit logging captures actions performed on the database to help track security events and troubleshoot issues.

2. Step 2: Compare options

   Options B, C, and D describe unrelated functions like speed, backup, or hardware monitoring, which are not audit logging purposes.

3. Final Answer:

   To record database actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security, not performance [OK]

Common Mistakes:

• Confusing audit logging with backup
• Thinking audit logs improve query speed
• Mixing audit logs with hardware monitoring

2. Which configuration file is used to enable audit logging in MongoDB?

easy

A. mongod.conf

B. mongo.cfg

C. audit.log

D. db.config

Solution

1. Step 1: Identify MongoDB config file

   MongoDB uses mongod.conf to configure server settings including audit logging.

2. Step 2: Eliminate incorrect options

   Files like mongo.cfg, audit.log, and db.config are not standard MongoDB config files.

3. Final Answer:

   mongod.conf -> Option A

4. Quick Check:

   Audit logging config = mongod.conf [OK]

Hint: MongoDB server settings are in mongod.conf [OK]

Common Mistakes:

• Confusing log file with config file
• Using wrong file extensions
• Assuming audit.log is a config file

3. Given this snippet in mongod.conf:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: { $in: ["authCheck", "createUser"] } }'

What events will be logged?

medium

A. No events will be logged due to syntax error

B. All database events

C. Only user deletion events

D. Only authentication checks and user creation events

Solution

1. Step 1: Analyze the filter field

   The filter uses atype with $in to include only "authCheck" and "createUser" event types.

2. Step 2: Understand event selection

   Only events matching these types will be logged, excluding others like user deletion or all events.

3. Final Answer:

   Only authentication checks and user creation events -> Option D

4. Quick Check:

   Filter limits events = authCheck, createUser [OK]

Hint: Filter with $in selects listed event types only [OK]

Common Mistakes:

• Assuming all events are logged
• Confusing createUser with deleteUser
• Thinking syntax error disables logging

4. You added this to mongod.conf but audit logs are not created:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: "authCheck" }'

What is the likely problem?

medium

A. Audit logging requires restart of mongod service

B. The path is invalid and MongoDB cannot write logs

C. Filter syntax is incorrect; it should use $in operator

D. Format JSON is not supported for audit logs

Solution

1. Step 1: Check configuration correctness

   The filter syntax is valid for a single event type; JSON format and path are correct.

2. Step 2: Consider service restart requirement

   Changes in mongod.conf require restarting the mongod service to apply new audit logging settings.

3. Final Answer:

   Audit logging requires restart of mongod service -> Option A

4. Quick Check:

   Config changes need restart [OK]

Hint: Restart mongod after config changes to enable audit logging [OK]

Common Mistakes:

• Assuming filter syntax error without checking
• Ignoring need to restart mongod
• Thinking JSON format is unsupported

5. You want to log all user management events except dropUser. Which filter correctly achieves this in mongod.conf?

hard

A. filter: '{ atype: { $in: ["createUser", "updateUser"] } }'

B. filter: '{ atype: { $eq: "dropUser" } }'

C. filter: '{ atype: { $nin: ["dropUser"] } }'

D. filter: '{ atype: "dropUser" }'

Solution

1. Step 1: Understand $nin operator

   The $nin operator excludes specified values, so { $nin: ["dropUser"] } excludes dropUser events.

2. Step 2: Check other options

   filter: '{ atype: { $in: ["createUser", "updateUser"] } }' logs only createUser and updateUser, missing other user events. Options B and C log only dropUser events, opposite of requirement.

3. Final Answer:

   filter: '{ atype: { $nin: ["dropUser"] } }' -> Option C

4. Quick Check:

   Exclude dropUser with $nin [OK]

Hint: Use $nin to exclude specific event types from audit logs [OK]

Common Mistakes:

• Using $in instead of $nin to exclude events
• Selecting only some user events instead of excluding one
• Confusing $eq with exclusion