Why Audit logging basics in MongoDB? - Purpose & Use Cases

The Big Idea

What if you could instantly know who changed what and when, without digging through messy notes?

The Scenario

Imagine you run a busy store and write down every sale on paper by hand. One day, a customer complains about a wrong charge, but your notes are messy and incomplete.

The Problem

Manually tracking every action is slow and easy to mess up. You might forget details or lose records, making it hard to find what really happened when problems arise.

The Solution

Audit logging automatically records every important action in a clear, organized way. This helps you quickly see who did what and when, without missing anything.

Before vs After

✗ Before

db.sales.insert({item: 'apple', price: 1}) // no record of who inserted or when

✓ After

db.audit.insert({action: 'insert', user: 'alice', time: new ISODate(), details: {item: 'apple', price: 1}})

What It Enables

Audit logging makes it easy to track changes and solve problems fast, keeping your system trustworthy and secure.

Real Life Example

In a bank, audit logs show who accessed accounts and what changes were made, helping catch fraud or mistakes quickly.

Key Takeaways

Manual tracking is slow and error-prone.

Audit logging records actions automatically and clearly.

This helps find issues and keep systems safe.

Practice

1. What is the main purpose of audit logging in MongoDB?

easy

A. To improve database query speed

B. To record database actions for security and troubleshooting

C. To backup data automatically

D. To monitor server hardware health

Solution

1. Step 1: Understand audit logging function

   Audit logging captures actions performed on the database to help track security events and troubleshoot issues.

2. Step 2: Compare options

   Options B, C, and D describe unrelated functions like speed, backup, or hardware monitoring, which are not audit logging purposes.

3. Final Answer:

   To record database actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security, not performance [OK]

Common Mistakes:

• Confusing audit logging with backup
• Thinking audit logs improve query speed
• Mixing audit logs with hardware monitoring

2. Which configuration file is used to enable audit logging in MongoDB?

easy

A. mongod.conf

B. mongo.cfg

C. audit.log

D. db.config

Solution

1. Step 1: Identify MongoDB config file

   MongoDB uses mongod.conf to configure server settings including audit logging.

2. Step 2: Eliminate incorrect options

   Files like mongo.cfg, audit.log, and db.config are not standard MongoDB config files.

3. Final Answer:

   mongod.conf -> Option A

4. Quick Check:

   Audit logging config = mongod.conf [OK]

Hint: MongoDB server settings are in mongod.conf [OK]

Common Mistakes:

• Confusing log file with config file
• Using wrong file extensions
• Assuming audit.log is a config file

3. Given this snippet in mongod.conf:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: { $in: ["authCheck", "createUser"] } }'

What events will be logged?

medium

A. No events will be logged due to syntax error

B. All database events

C. Only user deletion events

D. Only authentication checks and user creation events

Solution

1. Step 1: Analyze the filter field

   The filter uses atype with $in to include only "authCheck" and "createUser" event types.

2. Step 2: Understand event selection

   Only events matching these types will be logged, excluding others like user deletion or all events.

3. Final Answer:

   Only authentication checks and user creation events -> Option D

4. Quick Check:

   Filter limits events = authCheck, createUser [OK]

Hint: Filter with $in selects listed event types only [OK]

Common Mistakes:

• Assuming all events are logged
• Confusing createUser with deleteUser
• Thinking syntax error disables logging

4. You added this to mongod.conf but audit logs are not created:

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{ atype: "authCheck" }'

What is the likely problem?

medium

A. Audit logging requires restart of mongod service

B. The path is invalid and MongoDB cannot write logs

C. Filter syntax is incorrect; it should use $in operator

D. Format JSON is not supported for audit logs

Solution

1. Step 1: Check configuration correctness

   The filter syntax is valid for a single event type; JSON format and path are correct.

2. Step 2: Consider service restart requirement

   Changes in mongod.conf require restarting the mongod service to apply new audit logging settings.

3. Final Answer:

   Audit logging requires restart of mongod service -> Option A

4. Quick Check:

   Config changes need restart [OK]

Hint: Restart mongod after config changes to enable audit logging [OK]

Common Mistakes:

• Assuming filter syntax error without checking
• Ignoring need to restart mongod
• Thinking JSON format is unsupported

5. You want to log all user management events except dropUser. Which filter correctly achieves this in mongod.conf?

hard

A. filter: '{ atype: { $in: ["createUser", "updateUser"] } }'

B. filter: '{ atype: { $eq: "dropUser" } }'

C. filter: '{ atype: { $nin: ["dropUser"] } }'

D. filter: '{ atype: "dropUser" }'

Solution

1. Step 1: Understand $nin operator

   The $nin operator excludes specified values, so { $nin: ["dropUser"] } excludes dropUser events.

2. Step 2: Check other options

   filter: '{ atype: { $in: ["createUser", "updateUser"] } }' logs only createUser and updateUser, missing other user events. Options B and C log only dropUser events, opposite of requirement.

3. Final Answer:

   filter: '{ atype: { $nin: ["dropUser"] } }' -> Option C

4. Quick Check:

   Exclude dropUser with $nin [OK]

Hint: Use $nin to exclude specific event types from audit logs [OK]

Common Mistakes:

• Using $in instead of $nin to exclude events
• Selecting only some user events instead of excluding one
• Confusing $eq with exclusion