Query the audit log

Prerequisites

The audit log feature is enabled. For more information, see Enable the audit log feature.

Query audit logs

1. Log on to the MongoDB console.

2. Based on the instance type, click Replica Set Instances or Sharded Cluster Instances in the navigation pane on the left.

3. In the upper-left corner of the page, select the resource group and region where the instance is located.

4. Click the ID of the target instance, or click Manage in the Actions column for the instance.

5. In the navigation pane on the left of the instance details page, click Data Security > Audit Logs.

6. On the Mongo audit log center page, view audit log details. By default, the page displays logs from the last 15 Minutes (Relative).

   You can click Refresh in the upper-right corner of the Mongo audit log center page to set the audit log refresh frequency.

   • Once

     Refreshes the audit log once.

   • Automatic Refresh

     Automatically refreshes the audit log at intervals of 15 seconds, 60 seconds, 5 minutes, or 15 minutes.

     Note

     To disable the current auto-refresh interval, click Refresh > Disable and then set a new interval.

Filter audit logs

Use filters to narrow results and find specific audit log entries.

1. Log on to the MongoDB console.

2. Based on the instance type, click Replica Set Instances or Sharded Cluster Instances in the navigation pane on the left.

3. In the upper-left corner of the page, select the resource group and region where the instance is located.

4. Click the ID of the target instance, or click Manage in the Actions column for the instance.

5. In the navigation pane on the left of the instance details page, click Data Security > Audit Logs.

6. In the filter section of the Mongo audit log center page, set the filter conditions.

   The following table describes the filters.

   Filter	Description
   Keyword	Filters the audit log by keyword, such as a client IP address, executed command, account, or extended information. Keyword search requires an exact match. Fuzzy search is not supported. For example: To filter by a client IP address (IPv4), enter the full address in dotted-decimal notation, such as 192.168.1.1. Partial addresses such as 192.168 or 1.1 are not supported. To filter by an executed command, enter the full command name, such as AUTH or auth. Partial names such as au are not supported. If a keyword contains a colon (:), enclose it in double quotation marks (""), for example, "userId:1".
   Operation type	Filters the audit log by operation type.
   Client IP Address	Filters the audit log by the client IP address used to connect to the instance. For example: If an ECS instance connects to the ApsaraDB for MongoDB instance over the internet, enter the public IP address of the ECS instance. If an ECS instance connects to the ApsaraDB for MongoDB instance over a virtual private cloud (VPC), enter the private IP address of the ECS instance.
   Database Name	Filters the audit log by database name.
   Collection Name	Filters the audit log by collection name.
   Username	Filters the audit log by username.

Use the time picker

Use the time picker to query audit logs for different time ranges.

1. Log on to the MongoDB console.

2. Based on the instance type, click Replica Set Instances or Sharded Cluster Instances in the navigation pane on the left.

3. In the upper-left corner of the page, select the resource group and region where the instance is located.

4. Click the ID of the target instance, or click Manage in the Actions column for the instance.

5. In the navigation pane on the left of the instance details page, click Data Security > Audit Logs.

6. On the Mongo audit log center page, click Select time range on the right.

7. In the Select time range panel, select a time range.

   The following table describes the time picker sections.

   Section	Description
   Time details	When you hover over an option in the Relative time or Time frame section, this section displays the exact time range.
   Relative time	Selects a time period relative to the current time. Hover over an option to view the corresponding time range in the Time details section.
   Time frame	Selects a fixed time frame with a granularity of one minute or more. Hover over an option to view the corresponding time range in the Time details section.
   Custom time	Specifies a custom time range. After you enter a time range, click OK to apply it. Note The minimum query granularity is one minute. For second-level precision, log on to the Simple Log Service (SLS) console and use a query and analysis statement to retrieve audit log entries. For more information, see Quick start for log query and analysis.

Related APIs

FAQ

Q: Why can I query a maximum of only 2,000 audit log entries?

A: The Mongo audit log center page displays a maximum of 2,000 audit log entries. To query more entries, log on to the Simple Log Service (SLS) console. For more information, see Quick start for log query and analysis.

Q: Why do I have very little audit log data?

A: After you enable the audit log feature, only the Admin and slow operation types are selected by default. If you want to change the audited operation types, see Change audited operation types.