mongo Schema Audit Messagesmongo架构审核消息

authenticate

{
  user: <user name>,
  db: <database>,
  mechanism: <mechanism>
}

Starting in MongoDB 5.0, authenticate:从MongoDB 5.0开始，进行authenticate（身份验证）：

• Is logged for incomplete authentication attempts.记录了未完成的身份验证尝试。
• Includes the principle name and identifier in mechanism for external authentication mechanisms such as X.509 and Amazon Web Services Identity and Access Management (AWS-IAM) (see authMechanism).在X.509和Amazon Web Services身份和访问管理（AWS-IAM）等外部身份验证机制的机制中包括原则名称和标识符（请参阅authMechanism）。

authCheck

{
  command: <name>,
  ns: <database>.<collection>,
  args: <command object>
}

ns field is optional.字段是可选的。
args field may be redacted.字段可以被编辑。

By default, the auditing system logs only the authorization failures. To enable the system to log authorization successes, use the auditAuthorizationSuccess parameter.默认情况下，审核系统只记录授权失败。要使系统能够记录授权成功，请使用auditAuthorizationSuccess参数。

Enabling auditAuthorizationSuccess degrades performance more than logging only the authorization failures.启用auditAuthorizationSuccess比仅记录授权失败更会降低性能。

Starting in MongoDB 5.0, authCheck is not logged for actions that are generated internally.从MongoDB 5.0开始，内部生成的操作不会记录authCheck。

clientMetadata

{
   localEndpoint : {
      ip : <IP address of running instance>,
      port : <port of running instance>
   } || {
      unix : <MongoDB socket file path if connecting through
              a Unix domain socket>
   },
   clientMetadata : {
      driver : {
         name : <client driver name>,
         version : <client driver version>
      },
      os : {
         type : <client operating system type>,
         name : <client operating system name>,
         architecture : <client operating system architecture>,
         version : <client operating system version>
      },
      platform : <client platform name>,
      application : {
         name : <client application name>
      }
   }
}

Contains the client metadata. Logged when the client runs the hello command.包含客户端元数据。客户端运行hello命令时记录。

For more details, see Client Data.有关更多详细信息，请参阅客户端数据。

createCollection

{
   ns: <database>.<collection || view>,
   viewOn: <database>.<collection>,
   pipeline: [ <pipeline definition> ]
}

Logged when a:在以下情况下登录：

• Collection is created.集合已创建。
• View is created, with the view name logged in the ns field.创建视图，视图名称记录在ns字段中。

Starting in MongoDB 5.0, this additional information is logged for a view:从MongoDB 5.0开始，将为视图记录以下附加信息：

• viewOn field with the database and collection for the view.字段中包含视图的数据库和集合。
• pipeline field with the aggregation pipeline definition for the view.pipeline字段中包含视图的聚合管道定义。

{ ns: <database> }

createIndex

{
  ns: <database>.<collection>,
  indexName: <index name>,
  indexSpec: <index specification>,
  indexBuildState: <index build state>
}

Possible values for indexBuildState are:indexBuildState的可能值包括：

• IndexBuildStarted
• IndexBuildSucceeded
• IndexBuildAborted

Starting in MongoDB 5.0, createIndex audit events are:从MongoDB 5.0开始，createIndex审核事件是：

• Logged at the start and end of index creation, and includes a message indicating if the index was successfully created or not.在索引创建的开始和结束时记录，并包含一条消息，指示索引是否已成功创建。
• Attributed to the originating user for the action that caused the createIndex audit event.归因于导致createIndex审核事件的操作的发起用户。
• Logged for a createCollection event if the collection has an index.如果集合有索引，则记录createCollection事件。

0 - Success
276 - Index build aborted.索引构建已中止。

The audit message contains result code 276 for createIndex audit events with IndexBuildState set to IndexBuildAborted. 审计消息包含IndexBuildState设置为IndexBuildAborted的createIndex审计事件的结果代码276。The audit message contains result code 0 for createIndex audit events with IndexBuildState set to IndexBuildStarted or IndexBuildSucceeded.审核消息包含IndexBuildState设置为IndexBuildStarted或IndexBuildSucceded的createIndex审核事件的结果代码0。

directAuthMutation

{
   document: {
      <collection modifications>
   },
   ns: <database>.<collection>,
   operation: <database operation>
}

Logged when a database operation directly modifies the contents of the admin.system.users or admin.system.roles collections.当数据库操作直接修改admin.system.users或admin.system.roles集合的内容时记录。

{
  old: <database>.<collection>,
  new: <database>.<collection>
}

dropCollection

{
   ns: <database>.<collection || view>,
   viewOn: <database>.<collection>,
   pipeline: [ <pipeline definition> ]
}

Logged when a:在以下情况下登录：

• Collection is dropped.集合已删除。
• View is dropped, with the view name logged in the ns field.视图被删除，视图名称记录在ns字段中。

Starting in MongoDB 5.0, this additional information is logged for a view:从MongoDB 5.0开始，将为视图记录以下附加信息：

• viewOn field with the database and collection for the view.字段中包含视图的数据库和集合。
• pipeline field with the aggregation pipeline definition for the view.

In addition, starting in MongoDB 5.0, a dropCollection audit event is logged when a dropDatabase event occurs.

0 - Success
26 - NamespaceNotFound

If the collection or view does not exist, the audit message shows the return code as result: 26.如果集合或视图不存在，审核消息将显示返回代码result: 26。

{ ns: <database> }

{
  ns: <database>.<collection>,
  indexName: <index name>
}

{
  user: <user name>,
  db: <database>,
  customData: <document>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

The customData field is optional.customData字段是可选的。

{
  user: <user name>,
  db: <database>
}

{ db: <database> }

getClusterParameter

{
    requestedClusterServerParameters: <parameters>
}

setClusterParameter

{
    originalClusterServerParameter: <original parameter value>,
    updatedClusterServerParameter": <new parameter value>
}

updateCachedClusterServerParameter

{
    originalClusterServerParameter: <original parameter value>,
    updatedClusterServerParameter": <new parameter value>
}

Logged when a parameter is changed because of:由于以下原因更改参数时记录：

• Propagation of a setClusterParameter commandsetClusterParameter命令的传播
• Replication event such as rollback回滚等复制事件
• A refresh of new cluster parameter values from the config server on mongosmongos上配置服务器上新集群参数值的刷新

{
  user: <user name>,
  db: <database>,
  passwordChanged: <boolean>,
  customData: <document>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

The customData field is optional.customData字段是可选的。

{
  user: <user name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  user: <user name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ],
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

The roles and the privileges fields are optional.roles和privileges字段是可选的。

For details on the resource document, see Resource Document on Self-Managed Deployments. 有关资源文档的详细信息，请参阅关于自我管理部署的资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ],
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

The roles and the privileges fields are optional.roles和privileges字段是可选的。

For details on the resource document, see Resource Document on Self-Managed Deployments. 有关资源文档的详细信息，请参阅关于自我管理部署的资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  role: <role name>,
  db: <database>
}

{ db: <database> }

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  roles: [
     {
       role: <role name>,
       db: <database>
     },
     ...
  ]
}

{
  role: <role name>,
  db: <database>,
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

For details on the resource document, see Resource Document on Self-Managed Deployments. 有关资源文档的详细信息，请参阅关于自我管理部署的资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  role: <role name>,
  db: <database name>,
  privileges: [
    {
      resource: <resource document>,
      actions: [ <action>, ... ]
    },
    ...
  ]
}

For details on the resource document, see Resource Document on Self-Managed Deployments. 有关资源文档的详细信息，请参阅关于自我管理部署的资源文档。For a list of actions, see Privilege Actions.有关操作列表，请参阅权限操作。

{
  old: {
   _id: <replicaSetName>,
   version: <number>,
   ...
   members: [ ... ],
   settings: { ... }
  },
  new: {
   _id: <replicaSetName>,
   version: <number>,
   ...
   members: [ ... ],
   settings: { ... }
  }
}

For details on the replica set configuration document, see Self-Managed Replica Set Configuration.有关副本集配置文档的详细信息，请参阅自我管理副本集配置。

{ ns: <database> }

{
  ns: <database>.<collection>,
  key: <shard key pattern>,
  options: { unique: <boolean> }
}

{
  shard: <shard name>,
  connectionString: <hostname>:<port>,
}

When a shard is a replica set, the connectionString includes the replica set name and can include other members of the replica set.当分片是副本集时，connectionString包括副本集名称，并且可以包括副本集的其他成员。

{
  ns: <database>.<collection>,
  key: <shard key pattern>
}

{ shard: <shard name> }

{ }

Indicates commencement of database shutdown.表示数据库开始关闭。

{ msg: <custom message string> }

See logApplicationMessage.请参阅logApplicationMessage。

logout

{
  reason: <string>,
  initialUsers: [ <document>, ... ],
  updatedUsers: [ <document>, ... ],
}

reason will be either:将是：

• "Explicit logout from <database>"“从<database>显式注销”
• "Implicit logout due to client connection closure"“由于客户端连接关闭而隐式注销”

initialUsers is an array of documents containing users authenticated on the current client prior to logout.是一组文档，其中包含注销前在当前客户端上经过身份验证的用户。

updatedUsers is an array of documents containing users expected to be authenticated on the current client after the logout event.是一组文档，其中包含注销事件后预期在当前客户端上进行身份验证的用户。

Each document in initialUsers and updatedUsers contains:initialUsers和updatedUsers中的每个文档都包含：

• user: the username：用户名
• db: the database user is authenticated to：数据库user已通过身份验证

startup

{
    startupOptions: <document>,
    initialClusterServerParameter: <array of documents>
}

• startupOptions contains all of the options that the node has after startup包含节点启动后的所有选项

• initialClusterServerParameters contains the initial values of the cluster server parameters that the node has at the end of startup:包含节点在启动结束时具有的群集服务器参数的初始值：

  • after they have been loaded from storage (for mongod)从仓库装载后（适用于mongod）
  • after they have been refreshed from the config server (for mongos).从配置服务器刷新后（对于mongos）。