System Event Audit Messages系统事件审核消息

• isSystemUser that indicates whether the user who caused the event was a system user. 其指示引起事件的用户是否是系统用户。Logged for self-referential jobs initiated by a background process that runs on the same server instance.记录由运行在同一服务器实例上的后台进程启动的自引用作业。
• unix that contains the MongoDB socket file path if the client connects through a Unix domain socket.如果客户端通过Unix域套接字连接，则包含MongoDB套接字文件路径。

• isSystemUser that indicates whether the user who caused the event was a system user. 其指示引起事件的用户是否是系统用户。Logged for self-referential jobs initiated by a background process that runs on the same server instance.记录由运行在同一服务器实例上的后台进程启动的自引用作业。
• unix that contains the MongoDB socket file path if the client connects through a Unix domain socket.unix，如果客户端通过unix域套接字连接，则包含MongoDB套接字文件路径。

{
  user: <user name>,
  db: <database>,
  mechanism: <mechanism>
}

• Is logged for incomplete authentication attempts.记录了不完整的身份验证尝试。
• Includes the principle name and identifier in mechanism for external authentication mechanisms such as x.509 and Amazon Web Services Identity and Access Management (AWS-IAM) (see authMechanism).在外部身份验证mechanism（如x.509和Amazon Web服务标识和访问管理（AWS-IAM））的机制中包括主要名称和标识符（请参阅authMechanism）。

{
  command: <name>,
  ns: <database>.<collection>,
  args: <command object>
}

{
   localEndpoint : {
      ip : <IP address of running instance>,
      port : <port of running instance>
   } || {
      unix : <MongoDB socket file path if connecting through
              a Unix domain socket>
   },
   clientMetadata : {
      driver : {
         name : <client driver name>,
         version : <client driver version>
      },
      os : {
         type : <client operating system type>,
         name : <client operating system name>,
         architecture : <client operating system architecture>,
         version : <client operating system version>
      },
      platform : <client platform name>,
      application : {
         name : <client application name>
      }
   }
}

{
   ns: <database>.<collection || view>,
   viewOn: <database>.<collection>,
   pipeline: [ <pipeline definition> ]
}

• Collection is created.集合已创建。
• View is created, with the view name logged in the ns field.将创建视图，并在ns字段中记录视图名称。

• viewOn field with the database and collection for the view.字段，其中包含视图的数据库和集合。
• pipeline field with the aggregation pipeline definition for the view.具有视图的聚合管道定义的pipeline字段。

{ ns: <database> }

{
  ns: <database>.<collection>,
  indexName: <index name>,
  indexSpec: <index specification>,
  indexBuildState: <index build state>
}

• IndexBuildStarted
• IndexBuildSucceeded
• IndexBuildAborted

• Logged at the start and end of index creation, and includes a message indicating if the index was successfully created or not.在索引创建开始和结束时记录，并包含一条消息，指示索引是否已成功创建。
• Attributed to the originating user for the action that caused the createIndex audit event.归因于导致createIndex审核事件的操作的发起用户。
• Logged for a createCollection event if the collection has an index.如果集合具有索引，则记录createCollection事件。

{
   document: {
      <collection modifications>
   },
   ns: <database>.<collection>,
   operation: <database operation>
}

{
  old: <database>.<collection>,
  new: <database>.<collection>
}

{
   ns: <database>.<collection || view>,
   viewOn: <database>.<collection>,
   pipeline: [ <pipeline definition> ]
}

• Collection is dropped.集合已删除。
• View is dropped, with the view name logged in the ns field.视图被删除，视图名称记录在ns字段中。

• viewOn field with the database and collection for the view.字段，其中包含视图的数据库和集合。
• pipeline field with the aggregation pipeline definition for the view.具有视图的聚合管道定义的pipeline字段。

{ ns: <database> }

{
  ns: <database>.<collection>,
  indexName: <index name>
}

{
  user: <user name>,
  db: <database>,
  customData: <document>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  user: <user name>,
  db: <database>
}

{ db: <database> }

{
    requestedClusterServerParameters: <parameters>
}

{
    originalClusterServerParameter: <original parameter value>,
    updatedClusterServerParameter": <new parameter value>
}

{
    originalClusterServerParameter: <original parameter value>,
    updatedClusterServerParameter": <new parameter value>
}

• Propagation of a setClusterParameter commandsetClusterParameter命令的传播
• Replication event such as rollback回滚等复制事件
• A refresh of new cluster parameter values from the config server on mongos从mongos上的配置服务器刷新新的集群参数值

{
  user: <user name>,
  db: <database>,
  passwordChanged: <boolean>,
  customData: <document>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  user: <user name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  user: <user name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ],
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ],
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

{
  role: <role name>,
  db: <database>
}

{ db: <database> }

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

{
  role: <role name>,
  db: <database name>,
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

{
  old: {
   _id: <replicaSetName>,
   version: <number>,
   ...
   members: [ ... ],
   settings: { ... }
  },
  new: {
   _id: <replicaSetName>,
   version: <number>,
   ...
   members: [ ... ],
   settings: { ... }
  }
}

{ ns: <database> }

{
  ns: <database>.<collection>,
  key: <shard key pattern>,
  options: { unique: <boolean> }
}

{
  shard: <shard name>,
  connectionString: <hostname>:<port>,
}

{
  ns: <database>.<collection>,
  key: <shard key pattern>
}

{ shard: <shard name> }

{ }

{ msg: <custom message string> }

{
  reason: <string>,
  initialUsers: [ <document>, ... ],
  updatedUsers: [ <document>, ... ],
}

reason will be either:将是：

• "Explicit logout from <database>"“从<database>显式注销”
• "Implicit logout due to client connection closure"“由于客户端连接关闭而隐式注销”

Each document in initialUsers and updatedUsers contains:initialUsers和updatedUsers中的每个文档都包含：

• user: the username：用户名
• db: the database user is authenticated to：数据库user通过身份验证

{
    startupOptions: <document>,
    initialClusterServerParameter: <array of documents>
}

• startupOptions contains all of the options that the node has after startup包含节点启动后的所有选项
• initialClusterServerParameters contains the initial values of the cluster server parameters that the node has at the end of startup: 包含节点在启动结束时具有的群集服务器参数的初始值：
  • after they have been loaded from storage (for mongod)从存储中加载后（对于mongod）
  • after they have been refreshed from the config server (for mongos).在从配置服务器（对于mongos）刷新它们之后。