Details about the fields of MongoDB audit logs, slow query logs, and operational logs - ApsaraDB for MongoDB

Audit logs

Audit logs are stored in the Logstore named mongo_audit_log_standard. The following table describes the audit log fields.

Note

Audit logs and slow query logs share the same field names. To distinguish between the two, check the audit_type field. In slow query logs, the audit_type field is always slowop. Any other value indicates an audit log entry.

Field	Description
__topic__	The log topic. Fixed value: mongo_audit_log.
audit_type	The log type. Example: Command. When audit_type is 'command', it includes the specific commands listed in the following table.
coll	The collection name.
db	The database name.
docs_examined	The number of documents scanned.
instanceid	The ID of the ApsaraDB for MongoDB instance.
keys_examined	The number of index entries scanned.
latency	The elapsed time of the operation.
optype	The operation type. Valid values: query: Query data. find: Search for data. insert: Insert data. update: Update data. delete: Delete data. remove: Remove data. getMore: Read additional data. command: Protocol command.
return_num	The number of entries returned.
thread_id	The thread ID.
time	The timestamp.
user	The username used to log in to the ApsaraDB for MongoDB database.
user_ip	The client IP address used to access the ApsaraDB for MongoDB instance.

Commands included when audit_type is 'command'

The following table lists the specific commands audited when audit_type is 'command', grouped by category.

Command category	Specific commands
Query and aggregation commands	`aggregate`, `count`, `distinct`, `mapReduce`, `explain`, `getMore`, `killCursors`
Index operations	`createIndexes`, `dropIndexes`, `listIndexes`, `reIndex`
Collection and database operations	`create`, `drop`, `collMod`, `listCollections`, `listDatabases`, `dropDatabase`, `renameCollection`, `convertToCapped`
Server information and diagnostics	`serverStatus`, `buildInfo`, `ping`, `hello`, `isMaster`, `currentOp`, `killOp`, `collStats`, `dbStats`, `hostInfo`, `connectionStatus`, `top`
Maintenance and validation	`validate`, `compact`, `getParameter`, `setParameter`, `setFeatureCompatibilityVersion`
Replica set management	`replSetGetStatus`, `replSetGetConfig`, `replSetReconfig`, `replSetStepDown`, `replSetFreeze`, `replSetInitiate`
Sharding management	`enableSharding`, `shardCollection`, `addShard`, `removeShard`, `balancerStart`, `balancerStop`, `moveChunk`, `splitChunk`, `flushRouterConfig`
User management	`createUser`, `dropUser`, `updateUser`
Role management	`createRole`, `dropRole`, `grantRolesToUser`, `revokeRolesFromUser`, `usersInfo`, `rolesInfo`
Session management	`startSession`, `endSessions`, `killAllSessions`, `refreshSessions`
Transaction commands	`commitTransaction`, `abortTransaction`, `coordinateCommitTransaction`
Authentication commands	`authenticate`, `logout`, `saslStart`, `saslContinue`
System administration	`fsync`, `logRotate`, `shutdown`, `profile`
Plan cache commands	`planCacheClear`, `planCacheSetFilter`
Other commands	`dataSize`, `dbHash`

Slow query logs

Slow query logs are stored in the Logstore named mongo_slow_run_log. The following table describes the slow query log fields.

Field	Description
__topic__	The log topic. Fixed value: mongo_slow_log.
audit_type	The log type. Fixed value: slowop.
coll	The collection name.
db	The database name.
docs_examined	The number of documents scanned.
instanceid	The ID of the ApsaraDB for MongoDB instance.
keys_examined	The number of index entries scanned.
latency	The elapsed time of the operation.
optype	The operation type. Valid values: query: Query data. find: Search for data. insert: Insert data. update: Update data. delete: Delete data. remove: Remove data. getMore: Read additional data. command: Protocol command.
return_num	The number of entries returned.
thread_id	The thread ID.
time	The timestamp. Unit: seconds.
user	The username used to log in to the ApsaraDB for MongoDB database.
user_ip	The client IP address used to access the ApsaraDB for MongoDB instance.

Operational logs

Operational logs are stored in the Logstore named mongo_slow_run_log. The following table describes the operational log fields.

Field	Description
__topic__	The log topic. Fixed value: mongo_run_log.
category	The log category. Example: NETWORK (network connection logs).
connection	The connection information.
content	The log content.
instanceid	The ID of the ApsaraDB for MongoDB instance.
ip	The IP address.
level	The log severity level.
port	The port number.
time	The timestamp of the log entry.