Configure Auditing配置审核

Output to Syslog输出到Syslog

To enable auditing and print audit events to the syslog (option is unavailable on Windows) in JSON format, specify syslog for the --auditDestination setting. 要启用审核并以JSON格式将审核事件打印到syslog（选项在Windows上不可用），请为--auditDestination设置指定syslog。For example:例如：

mongod --dbpath data/db --auditDestination syslog

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅Localhost绑定兼容性更改。

You may also specify these options in the configuration file:您也可以在配置文件中指定以下选项：

storage:
   dbPath: data/db
auditLog:
   destination: syslog

Output to Console输出到控制台

To enable auditing and print the audit events to standard output (i.e. stdout), specify console for the --auditDestination setting. 要启用审核并将审核事件打印到标准输出（即stdout），请为--auditDestination设置指定控制台。For example:例如：

mongod --dbpath data/db --auditDestination console

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅Localhost绑定兼容性更改。

You may also specify these options in the configuration file:您也可以在配置文件中指定以下选项：

storage:
   dbPath: data/db
auditLog:
   destination: console

Output to JSON File输出到JSON文件

To enable auditing and print audit events to a file in JSON format, specify the following options:要启用审核并将审核事件打印到JSON格式的文件，请指定以下选项：

For example, the following enables auditing and records audit events to a file with the relative path name of data/db/auditLog.json:例如，以下内容启用审计并将审计事件记录到相对路径名为data/db/auditLog.json的文件中：

mongod --dbpath data/db --auditDestination file --auditFormat JSON --auditPath data/db/auditLog.json

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. For more information, see Localhost Binding Compatibility Changes.包括配置所需的其他选项。例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。有关详细信息，请参阅Localhost绑定兼容性更改。

The audit file may be rotated with the logRotate command, either alongside the server log or independently. 可以使用logRotate命令旋转审核文件，可以与服务器日志一起旋转，也可以独立旋转。Rotation specifics may be configured with the systemLog.logRotate configuration file option or the --logRotate command-line option.旋转细节可以使用systemLog.logRotate配置文件选项或--logRotate命令行选项进行配置。

You may also specify these options in the configuration file:您也可以在配置文件中指定以下选项：

storage:
   dbPath: data/db
auditLog:
   destination: file
   format: JSON
   path: data/db/auditLog.json

Output to BSON File输出到BSON文件

To enable auditing and print audit events to a file in BSON binary format, specify the following options:要启用审核并将审核事件打印到BSON二进制格式的文件，请指定以下选项：

For example, the following enables auditing and records audit events to a BSON file with the relative path name of data/db/auditLog.bson:例如，以下命令启用审核并将审核事件记录到BSON文件中，该文件的相对路径名为data/db/auditLog.bson：

mongod --dbpath data/db --auditDestination file --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 包括配置所需的其他选项。例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅Localhost绑定兼容性更改。

The audit file is rotated at the same time as the server log file. Rotation specifics may be configured with the systemLog.logRotate configuration file option or the --logRotate command-line option.审核文件与服务器日志文件同时旋转。旋转细节可以使用systemLog.logRotate配置文件选项或--logRotate命令行选项进行配置。

You may also specify these options in the configuration file:您也可以在配置文件中指定以下选项：

storage:
   dbPath: data/db
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson

The following example converts the audit log into readable form using bsondump and outputs the result:以下示例使用bsondump将审核日志转换为可读形式，并输出结果：

bsondump data/db/auditLog.bson

Separation of Concerns关注分离

Prior to MongoDB 5.0, anyone auditing a MongoDB mongod or mongos instance had to have write access to the host server's file system in order to update audit filters. 在MongoDB 5.0之前，任何审核MongoDB mongod或mongos实例的人都必须具有对主机服务器文件系统的写访问权限，才能更新审核筛选器。Runtime Audit Filter Management improves security by separating audit access from administrative access.运行时审核筛选器管理通过将审核访问与管理访问分离来提高安全性。

Using Runtime Audit Filter Management instead of editing configuration files directly means:使用运行时审核筛选器管理而不是直接编辑配置文件意味着：

• File system access is not required so an auditor does not need access to the mongod or mongos host server.不需要文件系统访问权限，因此审计员不需要访问mongod或mongos主机服务器。
• There is no direct access to the mongod or mongos instance's configuration file.无法直接访问mongod或mongos实例的配置文件。
• Runtime Audit Filter Management only exposes audit filters and the auditAuthorizationSuccess parameter.运行时审核筛选器管理仅公开审核筛选器和auditAuthorizationSuccess参数。

Runtime Configurability运行时可配置性

Starting in MongoDB 5.0, when Runtime Audit Filter Management is enabled, auditing can be reconfigured at runtime without restarting the mongod or mongos instance. A statically configured instance has to be restarted to update its audit settings.从MongoDB 5.0开始，当启用了运行时审计筛选器管理时，可以在运行时重新配置审计，而无需重新启动mongod或mongos实例。必须重新启动静态配置的实例才能更新其审核设置。

Audit filter modifications made at runtime persist when an instance is shutdown and restarted.当实例关闭并重新启动时，在运行时所做的审核筛选器修改将保持不变。

Consistency

Within a cluster, if all participating mongod and mongos nodes are configured to use Runtime Audit Filter Management, then every node will use the same audit filters. In contrast, if each node has its own locally configured audit filters, there is no guarantee of audit filter consistency across nodes.

Enable Runtime Audit Filter Management启用运行时审核筛选器管理

Starting in MongoDB 5.0, audit configurations for mongod and mongos nodes can be configured at runtime. A group of these nodes can take part in a distributed audit configuration.从MongoDB 5.0开始，可以在运行时配置mongod和mongos节点的审核配置。这些节点中的一组可以参与分布式审核配置。

To include a node in a distributed audit configuration, update the node's configuration file as follows and restart the server.要将节点包括在分布式审核配置中，请按如下方式更新节点的配置文件，然后重新启动服务器。

The server logs an error and fails to start if:如果出现以下情况，服务器将记录错误并无法启动：

• runtimeConfiguration is true and
• either auditLog.filter or auditAuthorizationSuccess is set.

To modify audit filters and the auditAuthorizationSuccess parameter at runtime, see setAuditConfig.要在运行时修改审核筛选器和auditAuthorizationSuccess参数，请参阅setAuditConfig。