Configure Auditing配置审核

Output to Syslog输出到Syslog

To enable auditing and print audit events to the syslog (option is unavailable on Windows) in JSON format, specify syslog for the --auditDestination setting. For example:要启用审核并以JSON格式将审核事件打印到syslog（Windows上没有此选项），请为--auditDestination设置指定syslog。例如：

mongod --dbpath data/db --auditDestination syslog

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

You may also specify these options in the configuration file:您也可以在配置文件中指定这些选项：

storage:
   dbPath: data/db
auditLog:
   destination: syslog

Output to Console输出到控制台

To enable auditing and print the audit events to standard output (i.e. stdout), specify console for the --auditDestination setting. For example:要启用审核并将审核事件打印到标准输出（即stdout），请为--auditDestination设置指定控制台。例如：

mongod --dbpath data/db --auditDestination console

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

You may also specify these options in the configuration file:您也可以在配置文件中指定这些选项：

storage:
   dbPath: data/db
auditLog:
   destination: console

Output to JSON File输出为JSON文件

To enable auditing and print audit events to a file in JSON format, specify the following options:要启用审核并将审核事件以JSON格式打印到文件中，请指定以下选项：

For example, the following enables auditing and records audit events to a file with the relative path name of data/db/auditLog.json:例如，以下内容允许审计并将审计事件记录到相对路径名为data/db/auditLog.json的文件中：

mongod --dbpath data/db --auditDestination file --auditFormat JSON --auditPath data/db/auditLog.json

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

The audit file may be rotated with the logRotate command, either alongside the server log or independently. 审计文件可以与logRotate命令一起旋转，可以与服务器日志一起旋转，也可以单独旋转。Rotation specifics may be configured with the systemLog.logRotate configuration file option or the --logRotate command-line option.可以使用systemLog.logRotate配置文件选项或--logRotate命令行选项配置旋转细节。

You may also specify these options in the configuration file:您也可以在配置文件中指定这些选项：

storage:
   dbPath: data/db
auditLog:
   destination: file
   format: JSON
   path: data/db/auditLog.json

Output to BSON File输出到BSON文件

To enable auditing and print audit events to a file in BSON binary format, specify the following options:要启用审核并将审核事件打印到BSON二进制格式的文件中，请指定以下选项：

For example, the following enables auditing and records audit events to a BSON file with the relative path name of data/db/auditLog.bson:例如，以下选项启用审核并将审核事件记录到相对路径名为data/db/auditLog.bson的BSON文件中：

mongod --dbpath data/db --auditDestination file --auditFormat BSON --auditPath data/db/auditLog.bson

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

The audit file is rotated at the same time as the server log file. 审计文件与服务器日志文件同时轮换。Rotation specifics may be configured with the systemLog.logRotate configuration file option or the --logRotate command-line option.可以使用systemLog.logRotate配置文件选项或--logRotate命令行选项配置旋转细节。

You may also specify these options in the configuration file:您也可以在配置文件中指定这些选项：

storage:
   dbPath: data/db
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson

The following example converts the audit log into readable form using bsondump and outputs the result:以下示例使用bsondump将审计日志转换为可读形式并输出结果：

bsondump data/db/auditLog.bson

Output Messages in OCSF Format以OCSF格式输出消息

Starting in MongoDB 8.0, MongoDB can write log messages in OCSF format. The OCSF schema provides logs in a standardized format compatible with log processors.从MongoDB 8.0开始，MongoDB可以以OCSF格式编写日志消息。OCSF模式以与日志处理器兼容的标准化格式提供日志。

To use the OCSF schema for log messages, set the --auditSchema option to OCSF. For example:要对日志消息使用OCSF模式，请将--auditSchema选项设置为OCSF。例如：

mongod --dbpath data/db --auditDestination file --auditFormat JSON --auditPath data/db/auditLog.json --auditSchema OCSF

You can also specify the OCSF schema in the auditLog.schema configuration file option:您还可以在auditLog.schema配置文件选项中指定OCSF架构：

storage:
   dbPath: data/db
auditLog:
   destination: file
   format: JSON
   path: data/db/auditLog.json
   schema: OCSF

For more information on the OCSF schema, see OCSF Schema Audit Messages.有关OCSF架构的更多信息，请参阅OCSF架构审核消息。

Separation of Concerns关注分离

Prior to MongoDB 5.0, anyone auditing a MongoDB mongod or mongos instance had to have write access to the host server's file system in order to update audit filters. 在MongoDB 5.0之前，任何审核MongoDB mongod或mongos实例的人都必须对主机服务器的文件系统具有写访问权限，才能更新审核筛选器。Runtime Audit Filter Management improves security by separating audit access from administrative access.运行时审核筛选器管理通过将审核访问与管理访问分离来提高安全性。

Using Runtime Audit Filter Management instead of editing configuration files directly means:使用运行时审核筛选器管理而不是直接编辑配置文件意味着：

• File system access is not required so an auditor does not need access to the mongod or mongos host server.不需要文件系统访问权限，因此审计员不需要访问mongod或mongos主机服务器。
• There is no direct access to the mongod or mongos instance's configuration file.无法直接访问mongod或mongos实例的配置文件。
• Runtime Audit Filter Management only exposes audit filters and the auditAuthorizationSuccess parameter.运行时审核筛选器管理仅公开审核筛选器和auditAuthorizationSuccess参数。

Runtime Configurability运行时可配置性

Starting in MongoDB 5.0, when Runtime Audit Filter Management is enabled, auditing can be reconfigured at runtime without restarting the mongod or mongos instance. 从MongoDB 5.0开始，启用运行时审计筛选器管理后，可以在运行时重新配置审计，而无需重新启动mongod或mongos实例。A statically configured instance has to be restarted to update its audit settings.必须重新启动静态配置的实例才能更新其审核设置。

Audit filter modifications made at runtime persist when an instance is shutdown and restarted.当实例关闭并重新启动时，在运行时所做的审核筛选器修改仍然有效。

Consistency一致性

Within a cluster, if all participating mongod and mongos nodes are configured to use Runtime Audit Filter Management, then every node will use the same audit filters. 在集群内，如果所有参与的mongod和mongos节点都配置为使用运行时审计筛选器管理，那么每个节点都将使用相同的审计筛选器。In contrast, if each node has its own locally configured audit filters, there is no guarantee of audit filter consistency across nodes.相比之下，如果每个节点都有自己的本地配置的审计筛选器，则无法保证跨节点的审计筛选器的一致性。

Enable Runtime Audit Filter Management启用运行时审核筛选器管理

Starting in MongoDB 5.0, audit configurations for mongod and mongos nodes can be configured at runtime. A group of these nodes can take part in a distributed audit configuration.从MongoDB 5.0开始，可以在运行时配置mongod和mongos节点的审计配置。一组这样的节点可以参与分布式审计配置。

To include a node in a distributed audit configuration, update the node's configuration file as follows and restart the server.要在分布式审计配置中包含节点，请按如下方式更新节点的配置文件，然后重新启动服务器。

The server logs an error and fails to start if:在以下情况下，服务器会记录错误并无法启动：

• runtimeConfiguration is true and
• either auditLog.filter or auditAuthorizationSuccess is set.设置了auditLog.filter或auditAuthorizationSuccess。

To modify audit filters and the auditAuthorizationSuccess parameter at runtime, see auditConfig.要在运行时修改审核筛选器和auditAuthorizationSuccess参数，请参阅auditConfig。