Set Up Database Auditing

Overview

Auditing allows administrators to track system activity for deployments with multiple users. Atlas administrators can select the actions that they want to audit, as well as the database users, Atlas roles, and LDAP groups whose actions they want audited. Atlas supports auditing of most of the documented system event actions, with the following limitations:

• When an Atlas user performs an action in the Atlas UI on a cluster, both the audit logs and mongodb.log file log the mms-automation database user as the user performing the auditable auction. However, the Project Activity Feed logs the actual username of the Atlas user responsible for the action.
• The Atlas audit logs don't track createUser events.

The authCheck event action logs authorization attempts by users trying to read from and write to databases in the clusters in your project. The following specific commands are audited:

Atlas implements the authCheck event action as the following four separate actions:

To learn about how MongoDB writes audit events to disk, see Audit Guarantee in the MongoDB Manual.

Procedure

Use the following procedure to set up database auditing:

To retrieve the audit logs in Atlas, see MongoDB Logs. To retrieve the audit logs using the API, see Logs.

Configure a Custom Auditing Filter

Atlas supports specifying a JSON-formatted audit filter for customizing MongoDB Auditing.

Custom audit filters allow users to forgo the managed Atlas UI auditing filter builder in favor of hand-tailored granular control of event auditing. Atlas only checks that the custom filter uses valid JSON syntax, and does not validate or test the filter's functionality.

The audit filter document must resolve to a query that matches one or more fields in the audit event message. The filter document can use combinations of query operators and equality conditions to match the desired audit messages.

For a selection of example auditing filters, see Example Auditing Filters. For complete documentation on configuring MongoDB auditing filters, see Configure Audit Filter.

Example Auditing Filters

Use the following example auditing filters for guidance in constructing your own filters.

{
  "atype": "authenticate"
}

{
  "$or": [
    {
      "users": []
    },
    {
      "atype": "authenticate"
    }
  ]
}

{
  "atype": "authenticate",
  "param": {
    "user": "myClusterAdministrator",
    "db": "admin",
    "mechanism": "SCRAM-SHA-1"
  }
}

{
  "atype": "authCheck",
  "param.command": {
    "$in": [
      "insert",
      "update",
      "delete"
    ]
  }
}