Charmed MongoDB 6 audit logging (VM charm)

Viewing Audit Logs

Audit logging is enabled by default in Charmed MongoDB and you can view audit logs in two ways: by viewing syslog or by viewing them in grafana.

Viewing logs using syslog

At the current moment, the audit log is being sent to syslog so, can check it by performing the following steps:

  1. ssh to unit, for example
juju ssh mongodb/leader

2 inside VM execute

tail -f /var/log/syslog 

in the console you will see audit log messages, for example

Jan 26 13:22:56 juju-f6ba89-2 mongod: { "atype" : "updateOperation", "ts" : { "$date" : "2024-01-26T13:22:56.300+00:00" }, "local" : { "ip" : "10.55.47.232", "port" : 27017 }, "remote" : {}, "users" : [], "roles" : [], "param" : { "ns" : "local.replset.oplogTruncateAfterPoint", "doc" : { "_id" : "oplogTruncateAfterPoint", "oplogTruncateAfterPoint" : { "$timestamp" : { "t" : 1706275376, "i" : 1 } } } }, "result" : 0 }

Accessing audit logs with grafana

Audit logs can be viewed with grafana using the Canonical Observability Stack. To view these logs:

  1. First integrate Charmed MongoDB with the Canonical Observability Stack. To do this follow the instructions on the How-To View Metrics in the section titled “Accessing metrics with grafana”
  2. Once grafana is active and you are able to access the GUI, navigate to the logging section and you will you will be able to see your audit log messages