System Event Audit Messages系统事件审核消息

uuid

Document that contains a universally unique identifier (UUID) for the audit message. 包含审核消息的通用唯一标识符（UUID）的文档。The $type field specifies the BSON subtype for the $binary field. $type字段指定$binary字段的BSON子类型。The $type value of 04 specifies that the $binary field contains a UUID.$type值04指定$binary字段包含UUID。

local

A document that contains the ip address and the port number of the running instance.包含正在运行的实例的ip地址和port号的文档。

Starting in MongoDB 5.0, can alternatively be a document with one of these fields:从MongoDB 5.0开始，也可以是具有以下字段之一的文档：

• isSystemUser that indicates whether the user who caused the event was a system user. 指示引起事件的用户是否是系统用户。Logged for self-referential jobs initiated by a background process that runs on the same server instance.已记录由在同一服务器实例上运行的后台进程启动的自引用作业。
• unix that contains the MongoDB socket file path if the client connects through a Unix domain socket.如果客户端通过Unix域套接字连接，则unix包含MongoDB套接字文件路径。

A document that contains the ip address and the port number of the incoming connection associated with the event.包含与事件关联的传入连接的ip地址和port号的文档。

Starting in MongoDB 5.0, can alternatively be a document with one of these fields:从MongoDB 5.0开始，也可以是具有以下字段之一的文档：

• isSystemUser that indicates whether the user who caused the event was a system user. 它指示引起事件的用户是否是系统用户。Logged for self-referential jobs initiated by a background process that runs on the same server instance.已记录由在同一服务器实例上运行的后台进程启动的自引用作业。
• unix that contains the MongoDB socket file path if the client connects through a Unix domain socket.如果客户端通过unix域套接字连接，则unix包含MongoDB套接字文件路径。

authenticate

{
  user: <user name>,
  db: <database>,
  mechanism: <mechanism>
}

Starting in MongoDB 5.0, authenticate:从MongoDB 5.0开始，authenticate：

• Is logged for incomplete authentication attempts.记录未完成的身份验证尝试。
• Includes the principle name and identifier in mechanism for external authentication mechanisms such as x.509 and Amazon Web Services Identity and Access Management (AWS-IAM) (see authMechanism).包括外部mechanism机制（如x.509和亚马逊Web服务身份和访问管理（AWS-IAM）（请参阅authMechanism）的机制中的原则名称和标识符。

authCheck

{
  command: <name>,
  ns: <database>.<collection>,
  args: <command object>
}

By default, the auditing system logs only the authorization failures. 默认情况下，审核系统只记录授权失败。To enable the system to log authorization successes, use the auditAuthorizationSuccess parameter.要使系统能够记录授权成功，请使用auditAuthorizationSuccess参数。

Enabling auditAuthorizationSuccess degrades performance more than logging only the authorization failures.启用 auditAuthorizationSuccess比只记录授权失败更会降低性能。

Starting in MongoDB 5.0, authCheck is not logged for actions that are generated internally.从MongoDB 5.0开始，内部生成的操作不会记录authCheck。

clientMetadata

{
   localEndpoint : {
      ip : <IP address of running instance>,
      port : <port of running instance>
   } || {
      unix : <MongoDB socket file path if connecting through
              a Unix domain socket>
   },
   clientMetadata : {
      driver : {
         name : <client driver name>,
         version : <client driver version>
      },
      os : {
         type : <client operating system type>,
         name : <client operating system name>,
         architecture : <client operating system architecture>,
         version : <client operating system version>
      },
      platform : <client platform name>,
      application : {
         name : <client application name>
      }
   }
}

Contains the client metadata. 包含客户端元数据。Logged when the client runs the hello command.当客户端运行hello命令时记录。

createCollection

{
   ns: <database>.<collection || view>,
   viewOn: <database>.<collection>,
   pipeline: [ <pipeline definition> ]
}

Logged when a:在以下情况下记录：

• Collection is created.集合已创建。
• View is created, with the view name logged in the ns field.创建视图，并将视图名称记录在ns字段中。

Starting in MongoDB 5.0, this additional information is logged for a view:从MongoDB 5.0开始，将为视图记录以下附加信息：

• viewOn field with the database and collection for the view.viewOn字段，其中包含视图的数据库和集合。
• pipeline field with the aggregation pipeline definition for the view.具有视图的聚合管道定义的pipeline字段。

{ ns: <database> }

createIndex

{
  ns: <database>.<collection>,
  indexName: <index name>,
  indexSpec: <index specification>,
  indexBuildState: <index build state>
}

Possible values for indexBuildState are:indexBuildState的可能值为：

• IndexBuildStarted
• IndexBuildSucceeded
• IndexBuildAborted

Starting in MongoDB 5.0, createIndex audit events are:从MongoDB 5.0开始，createIndex审核事件包括：

• Logged at the start and end of index creation, and includes a message indicating if the index was successfully created or not.在索引创建开始和结束时记录，并包含一条消息，指示索引是否成功创建。
• Attributed to the originating user for the action that caused the createIndex audit event.归因于导致createIndex审核事件的操作的原始用户。
• Logged for a createCollection event if the collection has an index.如果集合有索引，则记录createCollection事件。

The audit message contains result code 276 for createIndex audit events with IndexBuildState set to IndexBuildAborted. 审核消息包含IndexBuildState设置为IndexBuildAborted的createIndex审核事件的结果代码276。The audit message contains result code 0 for createIndex audit events with IndexBuildState set to IndexBuildStarted or IndexBuildSucceeded.审核消息包含IndexBuildState设置为IndexBuildStarted或IndexBuildSucceed的createIndex审核事件的结果代码0。

directAuthMutation

{
   document: {
      <collection modifications>
   },
   ns: <database>.<collection>,
   operation: <database operation>
}

Logged when a database operation directly modifies the contents of the admin.system.users or admin.system.roles collections.当数据库操作直接修改admin.system.users或admin.system.roles集合的内容时记录。

{
  old: <database>.<collection>,
  new: <database>.<collection>
}

dropCollection

{
   ns: <database>.<collection || view>,
   viewOn: <database>.<collection>,
   pipeline: [ <pipeline definition> ]
}

Logged when a:在以下情况下记录：

• Collection is dropped.集合已删除。
• View is dropped, with the view name logged in the ns field.视图已删除，视图名称记录在ns字段中。

Starting in MongoDB 5.0, this additional information is logged for a view:从MongoDB 5.0开始，将为视图记录以下附加信息：

• viewOn field with the database and collection for the view.viewOn字段，其中包含视图的数据库和集合。
• pipeline field with the aggregation pipeline definition for the view.具有视图的聚合管道定义的pipeline字段。

In addition, starting in MongoDB 5.0, a dropCollection audit event is logged when a dropDatabase event occurs.此外，从MongoDB 5.0开始，当发生dropDatabase事件时，会记录dropCollection审核事件。

If the collection or view does not exist, the audit message shows the return code as result: 26.如果集合或视图不存在，则审核消息将显示返回代码，为result: 26。

{ ns: <database> }

{
  ns: <database>.<collection>,
  indexName: <index name>
}

{
  user: <user name>,
  db: <database>,
  customData: <document>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

The customData field is optional.customData字段是可选的。

{
  user: <user name>,
  db: <database>
}

{ db: <database> }

{
  user: <user name>,
  db: <database>,
  passwordChanged: <boolean>,
  customData: <document>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

The customData field is optional.customData字段是可选的。

{
  user: <user name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  user: <user name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ],
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

The roles and the privileges fields are optional.roles字段和privileges字段是可选的。

For details on the resource document, see Resource Document. 有关资源文档的详细信息，请参阅资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ],
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

The roles and the privileges fields are optional.roles字段和privileges字段是可选的。

For details on the resource document, see Resource Document. 有关资源文档的详细信息，请参阅资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  role: <role name>,
  db: <database>
}

{ db: <database> }

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

For details on the resource document, see Resource Document. 有关资源文档的详细信息，请参阅资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  role: <role name>,
  db: <database name>,
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

For details on the resource document, see Resource Document. 有关资源文档的详细信息，请参阅资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  old: {
   _id: <replicaSetName>,
   version: <number>,
   ...
   members: [ ... ],
   settings: { ... }
  },
  new: {
   _id: <replicaSetName>,
   version: <number>,
   ...
   members: [ ... ],
   settings: { ... }
  }
}

For details on the replica set configuration document, see Replica Set Configuration.有关副本集配置文档的详细信息，请参阅副本集配置。

{ ns: <database> }

{
  ns: <database>.<collection>,
  key: <shard key pattern>,
  options: { unique: <boolean> }
}

{
  shard: <shard name>,
  connectionString: <hostname>:<port>,
  maxSize: <maxSize>
}

When a shard is a replica set, the connectionString includes the replica set name and can include other members of the replica set.当分片是副本集时，connectionString包含副本集名称，并且可以包含副本集的其他成员。

{
  ns: <database>.<collection>,
  key: <shard key pattern>
}

{ shard: <shard name> }

{ }

Indicates commencement of database shutdown.指示数据库关闭的开始。

{ msg: <custom message string> }

See logApplicationMessage.

logout

{
  reason: <string>,
  initialUsers: [ <document>, ... ],
  updatedUsers: [ <document>, ... ],
}

reason will be either:将是以下两者之一：

• "Explicit logout from <database>"“从<database>显式注销”
• "Implicit logout due to client connection closure"“由于客户端连接关闭导致隐式注销”

initialUsers is an array of documents containing users authenticated on the current client prior to logout.是一组文档，其中包含注销前在当前客户端上验证的用户。

updatedUsers is an array of documents containing users expected to be authenticated on the current client after the logout event.是一个文档数组，其中包含注销事件后预期在当前客户端上进行身份验证的用户。

Each document in initialUsers and updatedUsers contains:initialUsers和updatedUsers中的每个文档都包含：

• user: the username
• db: the database user is authenticated to：数据库user已通过身份验证

startup

{ options: <document> }

The options document contains the options the instance was started with.options文档包含实例启动时使用的选项。