注意
- 此功能不适用于
M0集群和Flex集群。
You can use Atlas Kubernetes Operator to configure audit logs. To learn more, see Set Up Database Auditing.
数据库审核使管理员追踪具有多个用户的部署的系统活动。Atlas 管理员可以选择要审核的操作、数据库用户、Atlas 角色和 LDAP 群组。Atlas 支持审核大多数记录的系统事件操作，但有以下限制：
When an Atlas user performs an action in the Atlas UI on a cluster, both the audit logs and
mongodb.logfile log themms-automationdatabase user as the user performing the auditable action. However, the Project Activity Feed logs the actual username of the Atlas user responsible for the action.Atlas 审核日志不追踪用户创建或修改事件，因为 Atlas 直接在
admin数据库中执行这些操作。
authCheck 事件操作将记录试图对项目集群中的数据库执行读取和写入的用户的授权尝试。Atlas 会审核以下特定命令：
authCheck Reads | authCheck Writes |
|---|---|
| [1] | (1, 2, 3) MongoDB versions 4.2 and later don't support these commands. |
Atlas 将 authCheck 事件操作实现为以下四个单独的操作：
事件操作 | 说明 |
|---|---|
|
|
|
警告：如果启用auditAuthorizationSuccess ，可能会严重影响集群性能。 请谨慎启用此选项。 |
|
|
|
警告：如果启用auditAuthorizationSuccess ，可能会严重影响集群性能。 请谨慎启用此选项。 |
To learn about how MongoDB writes audit events to disk, see Audit Guarantee in the MongoDB Manual.
必需的访问权限
To configure audit logs, you must have Project Owner access to the project that you want to update or Organization Owner access to the organization that contains the project that you want to update.
启用审核日志
注意
要学习 Atlas 审核临时数据库用户操作的最佳实践，请参阅Atlas 审核临时数据库用户。
AtlasProject要启用Atlas 审核日志，请在 自定义资源 中将 spec.auditing.enabled 设为 。true
示例：
cat <<EOF | kubectl apply -f - apiVersion: atlas.mongodb.com/v1 kind: AtlasProject metadata: name: my-project spec: name: TestAuditing connectionSecretRef: name: my-atlas-key projectIpAccessList: - cidrBlock: "0.0.0.0/1" comment: "Everyone has access. For test purposes only." - cidrBlock: "128.0.0.0/1" comment: "Everyone has access. For test purposes only." auditing: enabled: true EOF
To retrieve the audit logs in Atlas, see MongoDB Logs. To retrieve the audit logs using the API, see Logs.
配置自定义审核筛选器
注意
- 此功能不适用于
M0集群和Flex集群。
Atlas 支持指定 JSON 格式的审核过滤器，以自定义 MongoDB 审核。
Custom audit filters lets users forgo the managed Atlas UI auditing filter builder in favor of hand-tailored granular control of event auditing. Atlas checks only that the custom filter uses valid JSON syntax, and doesn't validate or test the filter's functionality.
审核过滤器文档必须解析为与审核事件消息中的一个或多个字段匹配的查询。过滤器文档可以使用查询操作符和等值条件的组合来匹配所需的审核消息。
To view example auditing filters, see Example Auditing Filters. To learn more about configuring MongoDB auditing filters, see Configure Audit Filter.
重要
Atlas uses a rolling update strategy for enabling or updating audit configuration settings across all clusters in the Atlas project. Rolling updates require at least one election per replica set.
To learn more about testing application resilience to replica set elections, see /tutorial/test-resilience/test-primary-failover. To learn more about how Atlas provides high availability, see Atlas High Availability.
要配置自定义Atlas 审核过滤器，请在 自定义资源 中指定 spec.auditing.auditFilter AtlasProject设置。要为此设置指定值，必须将 spec.auditing.enabled 设为 true。
示例：
cat <<EOF | kubectl apply -f - apiVersion: atlas.mongodb.com/v1 kind: AtlasProject metadata: name: my-project spec: name: TestAuditing connectionSecretRef: name: my-atlas-key projectIpAccessList: - cidrBlock: "0.0.0.0/1" comment: "Everyone has access. For test purposes only." - cidrBlock: "128.0.0.0/1" comment: "Everyone has access. For test purposes only." auditing: enabled: true auditFilter: "{"atype": "authenticate"}" EOF
To learn more about the configuration parameters available from the API, see the Atlas Auditing.