An authCheck event records a database authorization attempt, including reads and writes that either succeed or fail. It complements authentication events, which record login attempts. section 20.4
Use authCheck auditing with these operational considerations:
- Audit logs record operations such as aggregate, insert, update, and delete, along with the namespace, command, users, roles, network endpoints, and result. section 20.4
- MongoDB records failed authorization attempts by default; enable auditAuthorizationSuccess when successful reads and writes must also be investigated. section 20.4
- Full success logging can generate high log volume and add processing overhead on busy clusters, so enable it only for a clear monitoring need. section 20.4
- Review events in the Atlas UI or retrieve them through the Atlas API, then combine them with broader monitoring workflows. section 20.4
- Database auditing is unavailable for M0 and Flex clusters. section 20.4
Reading an authCheck record
A sample event records sampleUser successfully issuing find against sample_training.routes. The JSON includes atype authCheck, timestamp, server and client addresses, the command, result 0, and the user’s readWrite role. section 20.4
{
"atype": "authCheck",
"ts": {"$date": "2024-10-28T10:15:30.123Z"},
"local": {
"ip": "192.168.1.1",
"port": 27017
},
"remote": {
"ip": "203.0.113.42",
"port": 53245
},
"param": {
"ns": "sample_training.routes",
"command": "find",
"args": {},
"result": 0
},
"users": [
{
"user": "sampleUser",
"db": "admin"
}
],
"roles": [
{
"role": "readWrite",
"db": "sample_training"
}
]
}
Inspect the complete JSON event to see how authorization type, timestamp, namespace, command, result, users, roles, and network endpoints are represented. section 20.4
