setAuditConfig（数据库命令）

重要

在版本 7.1 中已弃用：请改用auditConfig集群参数。

定义

setAuditConfig

版本 5.0 中的新增功能。

setAuditConfig is an administrative command that sets new audit configurations for mongod and mongos server instances at runtime.

Use the db.adminCommand( { command } ) method to run setAuditConfig against the admin database.

兼容性

此命令可用于以下环境中托管的部署：

MongoDB Enterprise：基于订阅、自我管理的 MongoDB 版本
MongoDB Community：源代码可用、免费使用且可自行管理的 MongoDB 版本

重要

MongoDB Atlas 集群不支持此命令。有关 Atlas 对所有命令的支持的信息，请参阅不支持的命令。

语法

该命令具有以下语法：

db.adminCommand(
   {
     setAuditConfig: 1,
     filter: <Filter Document>,
     auditAuthorizationSuccess: <Boolean>
   }
)

命令字段

该命令具有以下字段：

字段	类型	说明
`setAuditConfig`	整型	运行 `setAuditConfig`
`filter`	文档	审核筛选器
`auditAuthorizationSuccess`	布尔	记录全部或仅记录失败的访问授权

行为

Enable auditing to use setAuditConfig at runtime.

auditAuthorizationSuccess启用对authCheck动作授权成功的审核。该参数值必须为true才能Atlas 审核读取和写入操作。但是，当auditAuthorizationSuccess为false时，审核对性能的影响，因为Atlas 审核系统仅记录授权失败。

Configuration updates are distributed via the oplog mechanism which means updates on mongod nodes are distributed to secondary nodes very quickly. There is a different distribution mechanism on mongos nodes. mongos nodes have to poll the primary server at regular intervals for configuration updates. You may see stale data due to polling delay if you run setAuditConfig on the primary server and getAuditConfig on a shard before the shard has polled the primary server for updated configuration details.

示例

在这些示例中，审核消息已重新格式化。它们在日志文件中显示在一行上。

审核集合的创建和删除

在创建或删除集合时启用审核。

db.admin.runCommand(
   {
      setAuditConfig: 1,
      filter:
         {
            atype:
               {
                  $in: [ "createCollection", "dropCollection" ]
               }
         },
      auditAuthorizationSuccess: false
   }
)

在sales数据库中创建inventory集合时，审核系统将记录如下消息：

{
   "atype" : "createCollection",
   "ts" : { "$date" : "2021-08-09T13:45:05.372+00:00" },
   "uuid" : { "$binary" : "RKU/YLizS6K9se2GUU7ZVQ==", "$type" : "04" },
   "local" : { "ip" : "127.0.0.1", "port" : 27502 },
   "remote" : { "ip" : "127.0.0.1", "port" : 51918 },
   "users" : [],
   "roles" : [],
   "param" : { "ns" : "sales.inventory" },
   "result" : 0
}

从sales数据库删除inventory集合时，审核系统将记录如下消息：

{
   "atype" : "dropCollection",
   "ts" : { "$date" : "2021-08-09T13:45:00.661+00:00" },
   "uuid" : { "$binary" : "0gle4/pSQli+LUcz43ykag==", "$type" : "04" },
   "local" : { "ip" : "127.0.0.1", "port" : 27502 },
   "remote" : { "ip" : "127.0.0.1", "port" : 51928 },
   "users" : [],
   "roles" : [],
   "param" : { "ns" : "sales.inventory" },
   "result" : 0
}

审核文档交互

将auditAuthorizationSuccess设置为true并创建一个筛选器，其中包含审核读写操作感兴趣的操作。

db.admin.runCommand(
   {
      setAuditConfig: 1,
      filter:
         {
            atype: "authCheck",
            "param.command":
               {
                  $in: [ "find", "insert", "delete", "update", "findandmodify" ]
               }
         },
      auditAuthorizationSuccess: true
   }
)

Atlas Search使用find命令在 sales 数据库中搜索 inventory 集合，创建如下审核日志条目：

{
   "atype" : "authCheck",
   "ts" : { "$date" : "2021-08-09T15:28:10.788+00:00" },
   "uuid" : { "$binary" : "ngwRt5CRTZqgE4TsfleoqQ==", "$type" : "04" },
   "local" : { "ip" : "127.0.0.1", "port" : 27502 },
   "remote" : { "ip" : "127.0.0.1", "port" : 51930 },
   "users" : [],
   "roles" : [],
   "param" : {
      "command" : "find",
      "ns" : "sales.inventory",
      "args" : {
         "find" : "inventory",
         "filter" : { "widget" : 1 },
         "lsid" : { "id" : { "$binary" : "FNWNxiitQ8GHKrHx8eJSbg==", "$type" : "04" } },
         "$clusterTime" : { "clusterTime" : { "$timestamp" : { "t" : 1628521381, "i" : 1 } },
         "signature" : { "hash" : { "$binary" : "AAAAAAAAAAAAAAAAAAAAAAAAAAA=", "$type" : "00" },
         "keyId" : { "$numberLong" : "0" } } },
         "$db" : "sales"
      }
   },
   "result" : 0
}

提示