Database auditing records security-relevant authentication, authorization, and database activity so administrators can review user actions and administrative changes. Atlas separates control-plane auditing from database auditing: control-plane logs cover actions in the Atlas UI, while database auditing covers selected activity inside an Atlas cluster. section 20.4 section 20.8
Choose the audit stream according to the activity that must be reviewed:
- Use Control Plane auditing to review project- and organization-level actions initiated through the Atlas UI; retrieve logs in the UI or through the Atlas API. section 20.4
- Use MongoDB database auditing to select actions, users, roles, and LDAP groups for monitoring within a project. section 20.4
- Use Atlas Stream Processing auditing to monitor authentication and entity-management events within a specific SPI; its log lasts for the SPI lifetime and remains for 30 days after deletion. section 15.8.4
- Plan capacity before enabling successful-operation logging: auditAuthorizationSuccess records every successful read and write, increasing log volume and potentially slowing busy clusters. section 20.4
Reading an authCheck event
An authCheck record can identify the namespace, command, result, local and remote addresses, user, database, and role. In the supplied example, a read operation targets sample_training.routes, the result is 0, and the user holds the readWrite role on sample_training. section 20.4
{
"atype": "authCheck",
"ts": {"$date": "2024-10-28T10:15:30.123Z"},
"local": {
"ip": "192.168.1.1",
"port": 27017
},
"remote": {
"ip": "203.0.113.42",
"port": 53245
},
"param": {
"ns": "sample_training.routes",
"command": "find",
"args": {},
"result": 0
},
"users": [
{
"user": "sampleUser",
"db": "admin"
}
],
"roles": [
{
"role": "readWrite",
"db": "sample_training"
}
]
}
Inspect the complete authCheck JSON record to see how network endpoints, commands, namespaces, results, users, and roles fit together. section 20.4
