Audit logging basics in MongoDB - Step-by-Step Execution

Concept Flow - Audit logging basics

Enable Audit Logging in Config

↓

MongoDB Starts with Audit

↓

Operations Occur

↓

Audit Logs Capture Events

↓

Logs Stored in File or DB

↓

Admin Reviews Logs for Security

This flow shows how enabling audit logging in MongoDB captures operations and stores them for review.

Execution Sample

MongoDB

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/auditLog.json
  filter: '{ atype: { $in: ["authCheck", "createCollection"] } }'

This config snippet enables audit logging to a JSON file, filtering only authentication checks and collection creation events.

Execution Table

Step	Action	Event Captured	Log Entry Created	Log Content Summary
1	MongoDB starts with audit logging enabled	No event yet	No	No log entry
2	User attempts login	authCheck	Yes	{"atype":"authCheck","user":"alice","result":"success"}
3	User creates collection	createCollection	Yes	{"atype":"createCollection","ns":"test.mycoll","user":"alice"}
4	User reads data	query	No	Filtered out by audit filter
5	User deletes document	delete	No	Filtered out by audit filter
6	Admin reviews audit log file	N/A	N/A	Sees only authCheck and createCollection events

💡 Audit logging captures only filtered events; other operations are ignored.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	Final
auditLog.enabled	false	true	true	true	true	true
auditLog.entries	[]	[authCheck event]	[authCheck, createCollection]	[authCheck, createCollection]	[authCheck, createCollection]	[authCheck, createCollection]

Key Moments - 2 Insights

Why are some operations like 'query' or 'delete' not logged?

Because the audit filter only includes 'authCheck' and 'createCollection' events, other operations are ignored as shown in execution_table rows 4 and 5.

Does audit logging slow down MongoDB operations?

Audit logging adds minimal overhead since it only logs filtered events asynchronously, as seen by the selective log entries in the execution_table.

Visual Quiz - 3 Questions

Look at the execution table, what event is logged at step 3?

A createCollection

B query

C authCheck

D delete

💡 Hint

Check the 'Event Captured' column at step 3 in the execution_table.

At which step does the audit log first contain an entry?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Log Entry Created' column in the execution_table.

If the filter is removed, what would change in the audit log entries?

A No events would be logged

B Only authCheck events would be logged

C All operations including query and delete would be logged

D Only createCollection events would be logged

💡 Hint

Consider the filter effect shown in the execution_table rows 4 and 5.

Concept Snapshot

Audit logging in MongoDB:
- Enable in config with 'auditLog' section
- Choose destination (file or syslog)
- Use filters to log specific event types
- Logs capture security and operational events
- Admins review logs for auditing and compliance

Full Transcript

Audit logging basics in MongoDB involve enabling audit logging in the configuration file. Once enabled, MongoDB records specific events like user authentication and collection creation based on filters. These logs are stored in a file or other destinations. The execution table shows how events are captured step-by-step, with only filtered events logged. Variables track the audit logging state and entries over time. Key moments clarify why some events are not logged and the performance impact. The visual quiz tests understanding of event logging steps and filter effects.

Practice

1. What is the main purpose of audit logging in MongoDB?

easy

A. To improve database query speed

B. To record database actions for security and troubleshooting

C. To backup data automatically

D. To monitor server hardware health

Solution

1. Step 1: Understand audit logging function

   Audit logging captures actions performed on the database to help track security events and troubleshoot issues.

2. Step 2: Compare options

   Options B, C, and D describe unrelated functions like speed, backup, or hardware monitoring, which are not audit logging purposes.

3. Final Answer:

   To record database actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security, not performance [OK]

Common Mistakes:

• Confusing audit logging with backup
• Thinking audit logs improve query speed
• Mixing audit logs with hardware monitoring

2. Which configuration file is used to enable audit logging in MongoDB?

easy

A. mongod.conf

B. mongo.cfg

C. audit.log

D. db.config

Solution

1. Step 1: Identify MongoDB config file

   MongoDB uses mongod.conf to configure server settings including audit logging.

2. Step 2: Eliminate incorrect options

   Files like mongo.cfg, audit.log, and db.config are not standard MongoDB config files.

3. Final Answer:

   mongod.conf -> Option A

4. Quick Check:

   Audit logging config = mongod.conf [OK]

Hint: MongoDB server settings are in mongod.conf [OK]

Common Mistakes:

• Confusing log file with config file
• Using wrong file extensions
• Assuming audit.log is a config file

3. Given this snippet in mongod.conf:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: { $in: ["authCheck", "createUser"] } }'

What events will be logged?

medium

A. No events will be logged due to syntax error

B. All database events

C. Only user deletion events

D. Only authentication checks and user creation events

Solution

1. Step 1: Analyze the filter field

   The filter uses atype with $in to include only "authCheck" and "createUser" event types.

2. Step 2: Understand event selection

   Only events matching these types will be logged, excluding others like user deletion or all events.

3. Final Answer:

   Only authentication checks and user creation events -> Option D

4. Quick Check:

   Filter limits events = authCheck, createUser [OK]

Hint: Filter with $in selects listed event types only [OK]

Common Mistakes:

• Assuming all events are logged
• Confusing createUser with deleteUser
• Thinking syntax error disables logging

4. You added this to mongod.conf but audit logs are not created:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: "authCheck" }'

What is the likely problem?

medium

A. Audit logging requires restart of mongod service

B. The path is invalid and MongoDB cannot write logs

C. Filter syntax is incorrect; it should use $in operator

D. Format JSON is not supported for audit logs

Solution

1. Step 1: Check configuration correctness

   The filter syntax is valid for a single event type; JSON format and path are correct.

2. Step 2: Consider service restart requirement

   Changes in mongod.conf require restarting the mongod service to apply new audit logging settings.

3. Final Answer:

   Audit logging requires restart of mongod service -> Option A

4. Quick Check:

   Config changes need restart [OK]

Hint: Restart mongod after config changes to enable audit logging [OK]

Common Mistakes:

• Assuming filter syntax error without checking
• Ignoring need to restart mongod
• Thinking JSON format is unsupported

5. You want to log all user management events except dropUser. Which filter correctly achieves this in mongod.conf?

hard

A. filter: '{ atype: { $in: ["createUser", "updateUser"] } }'

B. filter: '{ atype: { $eq: "dropUser" } }'

C. filter: '{ atype: { $nin: ["dropUser"] } }'

D. filter: '{ atype: "dropUser" }'

Solution

1. Step 1: Understand $nin operator

   The $nin operator excludes specified values, so { $nin: ["dropUser"] } excludes dropUser events.

2. Step 2: Check other options

   filter: '{ atype: { $in: ["createUser", "updateUser"] } }' logs only createUser and updateUser, missing other user events. Options B and C log only dropUser events, opposite of requirement.

3. Final Answer:

   filter: '{ atype: { $nin: ["dropUser"] } }' -> Option C

4. Quick Check:

   Exclude dropUser with $nin [OK]

Hint: Use $nin to exclude specific event types from audit logs [OK]

Common Mistakes:

• Using $in instead of $nin to exclude events
• Selecting only some user events instead of excluding one
• Confusing $eq with exclusion