Auditability records security-relevant actions and events so teams can review user activity, investigate access, and support security-policy compliance. Atlas provides two complementary forms: Control Plane auditing records actions from the Atlas UI at project and organization levels, while MongoDB database auditing records selected database activities and user actions within a project. section 20.4 section 21.3.2
Use audit logs with these operational distinctions:
- Retrieve Control Plane records through the Atlas UI or Atlas API for review and integration with monitoring workflows. section 20.4
- Filter database auditing by actions such as reads and writes, users, roles, and LDAP groups; authentication and authorization events include success or failure details. section 20.4
- Expect failed authorization attempts by default; enable auditAuthorizationSuccess only when successful reads and writes are necessary, because full logging increases volume and processing overhead. section 20.4
- Review logs in the Atlas UI or download them with the Atlas CLI; filter by type, status, timestamp, user, or request ID when investigating activity. section 21.3.2
Reading an authorization event
An authCheck record can identify the database namespace, command, local and remote addresses, user, role, timestamp, and result. For example, a successful find on sample_training.routes can be associated with sampleUser using the readWrite role.
