On this page本页内容
MongoDB Enterprise includes an auditing capability for MongoDB Enterprise包括mongod and mongos instances. mongod和mongos实例的审计功能。The auditing facility allows administrators and users to track system activity for deployments with multiple users and applications.审核功能允许管理员和用户跟踪多个用户和应用程序部署的系统活动。
The auditing facility can write audit events to the console, the syslog, a JSON file, or a BSON file. 审计工具可以将审计事件写入控制台、系统日志、JSON文件或BSON文件。To enable auditing in MongoDB Enterprise, set an audit output destination with 要在MongoDB Enterprise中启用审计，请使用--auditDestination. --auditDestination设置审计输出目标。For details, see Configure Auditing.有关详细信息，请参阅配置审核。
For information on the audit log messages, see System Event Audit Messages.有关审核日志消息的信息，请参阅系统事件审核消息。
Once enabled, the auditing system can record the following operations [1]:启用后，审核系统可以记录以下操作[1]：
auditAuthorizationSuccess set to true).auditAuthorizationSuccess设置为true）。Starting in MongoDB 5.0, secondaries do not log DDL audit events for replicated changes. 从MongoDB 5.0开始，secondaries不记录复制更改的DDL审核事件。DDL audit events are still logged for DDL operations that modify the local database and the 对于修改本地数据库和system.profile collection.system.profile集合的DDL操作，仍会记录DDL审核事件。
For details on audited actions, see Audit Event Actions, Details, and Results.有关已审核操作的详细信息，请参阅审核事件操作、详细信息和结果。
With the auditing system, you can set up filters to restrict the events captured. 使用审核系统，您可以设置筛选器以限制捕获的事件。To set up filters, see Configure Audit Filters.要设置筛选器，请参阅配置审核筛选器。
| [1] |
The auditing system writes every audit event [2] to an in-memory buffer of audit events. 审计系统将每个审计事件[2]写入审计事件的内存缓冲区。MongoDB writes this buffer to disk periodically. MongoDB定期将此缓冲区写入磁盘。For events collected from any single connection, the events have a total order: if MongoDB writes one event to disk, the system guarantees that it has written all prior events for that connection to disk.对于从任何单个连接集合的事件，事件有一个总的顺序：如果MongoDB将一个事件写入磁盘，系统保证它已将该连接的所有先前事件写入磁盘。
If an audit event entry corresponds to an operation that affects the durable state of the database, such as a modification to data, MongoDB will always write the audit event to disk before writing to the journal for that entry.如果审计事件条目对应于影响数据库持久状态的操作，例如对数据的修改，MongoDB将始终在写入该条目的日志之前将审计事件写入磁盘。
That is, before adding an operation to the journal, MongoDB writes all audit events on the connection that triggered the operation, up to and including the entry for the operation.也就是说，在将操作添加到日志之前，MongoDB会写入触发该操作的连接上的所有审核事件，直到并包括该操作的条目。
These auditing guarantees require that MongoDB run with 这些审计保证要求MongoDB在启用journaling enabled.journaling的情况下运行。
MongoDB may lose events if the server terminates before it commits the events to the audit log. 如果服务器在将事件提交到审核日志之前终止，MongoDB可能会丢失事件。The client may receive confirmation of the event before MongoDB commits to the audit log. 客户端可能会在MongoDB提交到审核日志之前收到事件确认。For example, while auditing an aggregation operation, the server might crash after returning the result but before the audit log flushes.例如，在审核聚合操作时，服务器可能在返回结果后但在审核日志刷新之前崩溃。
| [2] |