Configure Audit Filters配置审核筛选器

Configuration File Usage配置文件使用情况

Filters can be specified in YAML under the auditLog session of the configuration file. See the examples below for sample configurations.筛选器可以在配置文件的auditLog会话下的YAML中指定。有关示例配置，请参阅下面的示例。

Record All Auditable Events记录所有可审计事件

To record all auditable events, do not specify an audit filter. By default, the audit facility records all auditable operations.要记录所有可审核的事件，请不要指定审核筛选器。默认情况下，审计工具会记录所有可审计的操作。

Filter for Multiple Operation Types多种操作类型的筛选器

The following example audits only the createCollection and dropCollection actions by using the filter:以下示例使用筛选器仅审核createCollection和dropCollection操作：

{ atype: { $in: [ "createCollection", "dropCollection" ] } }

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auditDestination file --auditFilter '{ atype: { $in: [ "createCollection", "dropCollection" ] } }' --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }'

Filter on Authentication Operations on a Single Database对单个数据库上的身份验证操作进行筛选

The <field> can include any field in the audit message. For authentication operations (i.e. atype: "authenticate"), the audit messages include a db field in the param document.<field>可以包含审核消息中的任何字段。对于身份验证操作（即atype: "authenticate"），审计消息在param文档中包含一个db字段。

The following example audits only the authenticate operations that occur against the test database by using the filter:以下示例仅审核使用筛选器对测试数据库进行的authenticate（身份验证）操作：

{ atype: "authenticate", "param.db": "test" }

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ atype: "authenticate", "param.db": "test" }' --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: "authenticate", "param.db": "test" }'

To filter on all authenticate operations across databases, omit "param.db": "test" and use the filter { atype: "authenticate" }.要筛选跨数据库的所有authenticate（身份验证）操作，请省略"param.db": "test"，并使用筛选器{ atype: "authenticate" }。

Filter on Collection Creation and Drop Operations for a Single Database对单个数据库的集合创建和删除操作进行筛选

The <field> can include any field in the audit message. For collection creation and drop operations (i.e. atype: "createCollection" and atype: "dropCollection"), the audit messages include a namespace ns field in the param document.<field>可以包含审核消息中的任何字段。对于集合创建和删除操作（即atype: "createCollection"和atype: "dropCollection"），审计消息在param文档中包含一个命名空间ns字段。

The following example audits only the createCollection and dropCollection operations that occur against the test database by using the filter:以下示例仅使用筛选器审核针对test数据库发生的createCollection和dropCollection操作：

{ atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test\\./ }

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test\\./ }' --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test\\./ }'

Filter by Authorization Role按授权角色筛选

The following example audits operations by users with readWrite role on the test database, including users with roles that inherit from readWrite, by using the filter:以下示例使用筛选器审核test数据库上具有readWrite角色的用户的操作，包括具有从readWrite继承的角色的用户：

{ roles: { role: "readWrite", db: "test" } }

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ roles: { role: "readWrite", db: "test" } }' --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ roles: { role: "readWrite", db: "test" } }'

Filter on Read and Write Operations读写操作筛选器

To capture read and write operations in the audit, you must also enable the audit system to log authorization successes using the auditAuthorizationSuccess parameter. 要捕获审核中的读写操作，您还必须启用审核系统，使用auditAuthorizationSuccess参数记录授权成功。[1]

This filter audits multiple read and write operations:此筛选器审核多个读写操作：

{
   atype: "authCheck",
   "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] }
}

The audited operations include:经审计的业务包括：

• find()
• insertOne()
• insertMany()
• remove()
• updateOne()
• updateMany()
• findAndModify()

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFilter '{ atype: "authCheck", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }' --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: "authCheck", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }'
setParameter: { auditAuthorizationSuccess: true }

Filter on Read and Write Operations for a Collection对集合的读写操作进行筛选

To capture read and write operations in the audit, you must also enable the audit system to log authorization successes using the auditAuthorizationSuccess parameter. 要捕获审核中的读写操作，您还必须启用审核系统，使用auditAuthorizationSuccess参数记录授权成功。[1]

This filter audits multiple read and write operations on the orders collection in the test database:此筛选器审核test数据库中orders集合的多个读写操作：

{
    atype: "authCheck",
    "param.ns": "test.orders",
    "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] }
}

The audited operations include:经审计的业务包括：

• find()
• insertOne()
• insertMany()
• remove()
• updateOne()
• updateMany()
• findAndModify()

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFilter '{ atype: "authCheck", "param.ns": "test.orders", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }' --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: "authCheck", "param.ns": "test.orders", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }'
setParameter: { auditAuthorizationSuccess: true }

Filter OCSF Schema Log Messages筛选OCSF架构日志消息

Starting in MongoDB 8.0, MongoDB can write log messages in OCSF format. The OCSF schema contains different fields than the default mongo schema.从MongoDB 8.0开始，MongoDB可以以OCSF格式编写日志消息。OCSF模式包含与默认mongo模式不同的字段。

The following audit filter captures Network Activity actions that are recorded in the OCSF schema:以下审核筛选器捕获记录在OCSF架构中的网络活动操作：

{ category_uid: 4 }

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFilter '{ category_uid: 4 }' --auditFormat JSON --auditSchema OCSF --auditPath data/db/auditLog.json

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: JSON
   path: data/db/auditLog.json
   filter: '{ category_uid: 4 }'
   schema: OCSF
setParameter: { auditAuthorizationSuccess: true }

For more information on OCSF log messages, see OCSF Schema Audit Messages.有关OCSF日志消息的更多信息，请参阅OCSF架构审核消息。

Specify Top-Level Query Operators ($or)指定顶级查询运算符（$or）

To filter on multiple audit message fields, you can specify a top-level query operator like $or. 要筛选多个审核消息字段，您可以指定一个顶级查询运算符，如$or。For example, the following filter captures operations where either atype is authenticate or the operation was performed by a user with the readWrite role:例如，以下筛选器捕获了atype为authenticate或由具有readWrite角色的用户执行的操作：

{
   $or: [
      { atype: "authenticate" },
      { "roles.role": "readWrite" }
   ]
}

To specify an audit filter, enclose the filter document in single quotes to pass the document as a string.要指定审核筛选器，请将筛选器文档括在单引号中，以字符串形式传递文档。

mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFilter '{ $or: [ { atype: "authenticate" }, { "roles.role": "readWrite" } ] }' --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

To specify the audit filter in a configuration file, you must use the YAML format of the configuration file.要在配置文件中指定审核筛选器，必须使用配置文件的YAML格式。

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ $or: [ { atype: "authenticate" }, { "roles.role": "readWrite" } ] }'