MongoDB Enterprise provides the capability to audit mongod and mongos instances. The auditing facility allows administrators and users to track system activity for deployments with multiple users and applications. Administrators can configure auditing to write to the console, syslog, a JSON file or a BSON file. You can also use filters to restrict which events are logged.
If you're running MongoDB Enterprise version 5.0 or later and MongoDB Agent 22.214.171.12455 or later, you can:
Set separate rules for rotating server logs and audit logs.
Compress and delete audit logs using Ops Manager. For security reasons, we recommend managing your audit log compression and deletion outside of Ops Manager.
If you're running earlier versions of MongoDB Enterprise or the MongoDB Agent, Ops Manager:
Uses your System Log Rotation settings to rotate both the server logs and the audit logs.
Doesn't compress or delete audit logs. If you configure compression and deletion, Ops Manager applies these settings to the server logs only.
MongoDB Community users can rotate, compress, and delete the server logs only.
Your Ops Manager cluster must run MongoDB Enterprise, version 2.6 or later, to configure and deploy auditing.
(Optional) To filter which events are audited, repeat steps 1-4 and add the
For information about how to create filters, see Configure Audit Filters.