Audit logging basics in MongoDB - Step-by-Step Execution

Concept Flow - Audit logging basics

Enable Audit Logging in Config

↓

MongoDB Starts with Audit

↓

Operations Occur

↓

Audit Logs Capture Events

↓

Logs Stored in File or DB

↓

Admin Reviews Logs for Security

This flow shows how enabling audit logging in MongoDB captures operations and stores them for review.

Execution Sample

MongoDB

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/auditLog.json
  filter: '{ atype: { $in: ["authCheck", "createCollection"] } }'

This config snippet enables audit logging to a JSON file, filtering only authentication checks and collection creation events.

Execution Table

Step	Action	Event Captured	Log Entry Created	Log Content Summary
1	MongoDB starts with audit logging enabled	No event yet	No	No log entry
2	User attempts login	authCheck	Yes	{"atype":"authCheck","user":"alice","result":"success"}
3	User creates collection	createCollection	Yes	{"atype":"createCollection","ns":"test.mycoll","user":"alice"}
4	User reads data	query	No	Filtered out by audit filter
5	User deletes document	delete	No	Filtered out by audit filter
6	Admin reviews audit log file	N/A	N/A	Sees only authCheck and createCollection events

💡 Audit logging captures only filtered events; other operations are ignored.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	Final
auditLog.enabled	false	true	true	true	true	true
auditLog.entries	[]	[authCheck event]	[authCheck, createCollection]	[authCheck, createCollection]	[authCheck, createCollection]	[authCheck, createCollection]

Key Moments - 2 Insights

Why are some operations like 'query' or 'delete' not logged?

Because the audit filter only includes 'authCheck' and 'createCollection' events, other operations are ignored as shown in execution_table rows 4 and 5.

Does audit logging slow down MongoDB operations?

Audit logging adds minimal overhead since it only logs filtered events asynchronously, as seen by the selective log entries in the execution_table.

Visual Quiz - 3 Questions

Look at the execution table, what event is logged at step 3?

A createCollection

B query

C authCheck

D delete

💡 Hint

Check the 'Event Captured' column at step 3 in the execution_table.

At which step does the audit log first contain an entry?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Log Entry Created' column in the execution_table.

If the filter is removed, what would change in the audit log entries?

A No events would be logged

B Only authCheck events would be logged

C All operations including query and delete would be logged

D Only createCollection events would be logged

💡 Hint

Consider the filter effect shown in the execution_table rows 4 and 5.

Concept Snapshot

Audit logging in MongoDB:
- Enable in config with 'auditLog' section
- Choose destination (file or syslog)
- Use filters to log specific event types
- Logs capture security and operational events
- Admins review logs for auditing and compliance

Full Transcript

Audit logging basics in MongoDB involve enabling audit logging in the configuration file. Once enabled, MongoDB records specific events like user authentication and collection creation based on filters. These logs are stored in a file or other destinations. The execution table shows how events are captured step-by-step, with only filtered events logged. Variables track the audit logging state and entries over time. Key moments clarify why some events are not logged and the performance impact. The visual quiz tests understanding of event logging steps and filter effects.