Skip to content

Commit 4485252

Browse files
JuliaMongoJuliaMongo
authored
(DOCSP-43346) Auditing and Logging (#33)
* Draft * Add TF example * Copy review
1 parent 71fdfb0 commit 4485252

File tree

5 files changed

+161
-23
lines changed

5 files changed

+161
-23
lines changed

‎source/auditing-logging.txt‎

Lines changed: 93 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
.. _arch-center-auditing-logging:
22

33
====================
4-
Auditing and Logging
4+
Auditing and Logging
55
====================
66

77
.. default-domain:: mongodb
@@ -12,40 +12,117 @@ Auditing and Logging
1212
:depth: 1
1313
:class: onecol
1414

15-
Intro statement
15+
To monitor and log |service| platform activities, use auditing and logs.
1616

1717
{+service+} Features and Best Practices for Auditing and Logging
1818
----------------------------------------------------------------
1919

20-
Content here
20+
.. _auditing:
2121

22-
Examples
23-
--------
22+
Auditing
23+
~~~~~~~~
2424

25-
The following examples <perform this action> using |service|
26-
:ref:`tools for automation <arch-center-automation>`.
25+
Database auditing lets you track system activity for deployments with
26+
multiple users. As a |service| administrator, you can:
2727

28-
.. tabs::
28+
- Rely on default auditing settings in |service|. By default, |service|
29+
performs database authentication auditing in ``M10+`` {+clusters+} to
30+
record authentication events, including those pertaining to:
31+
32+
- database users
33+
- source IP addresses
34+
- timestamps for successful and failed attempts
35+
36+
- Configure a JSON-formatted audit filter to customize MongoDB auditing
37+
and select the actions, database users, |service| roles, and |ldap| groups
38+
that you want to audit. If you create a custom audit filter, you can
39+
skip using the managed {+atlas-ui+} auditing filter builder and configure
40+
your own tailored filter of event auditing.
41+
42+
You can :manual:`configure manual auditing </core/auditing>` of most of the
43+
documented :manual:`system event actions </reference/audit-message/mongo/>`
44+
in |service|. Granular MongoDB database auditing allows you to track
45+
usage of all DDL (Data Definition Language), DML (Data Manipulation Language),
46+
and DCL (Data Control Language) commands in detail. For a full list of
47+
events you can configure for auditing, and for a list of examples,
48+
see :manual:`MongoDB auditing </core/auditing>`. See also
49+
:atlas:`Set up Database Auditing </database-auditing>`.
50+
51+
- :atlas:`Audit the actions of temporary database users </production-notes/#audit-temporary-database-users>`.
52+
53+
.. _accessing-audit-logs:
54+
55+
Accessing Audit Logs
56+
~~~~~~~~~~~~~~~~~~~~~
57+
58+
.. include:: /includes/cloud-docs/logs.rst
59+
60+
To retrieve the audit logs using the {+atlas-admin-api+}, see
61+
:oas-atlas-op:`Logs </downloadLogsForOneClusterHostInOneProject>`. You
62+
can use these API commands:
63+
64+
- :ref:`atlas-auditing-describe <atlas-auditing-describe>` returns the
65+
auditing configuration for the specified project.
66+
- :ref:`atlas-auditing-update <atlas-auditing-update>` updates
67+
the auditing configuration for the specified project.
2968

30-
.. tab:: Dev and Test Environments
31-
:tabid: devtest
69+
You can :ref:`view authentication attempts <access-tracking>` that users
70+
make against your {+cluster+}. |service| logs both successful and unsuccessful
71+
authentication attempts, including the timestamp of each attempt and which
72+
user tried to authenticate.
3273

33-
.. include:: /includes/shared-settings-clusters-devtest.rst
74+
You can :ref:`view and filter the activity feed <view-activity-feed>`
75+
for an organization or project.
3476

35-
.. tab:: Staging and Prod Environments
36-
:tabid: stagingprod
77+
To perform a full audit, you can use a combination of audit logs,
78+
the ``mongodb.log``, and :ref:`the project activity feed <view-activity-feed>`.
3779

38-
.. include:: /includes/shared-settings-clusters-stagingprod.rst
80+
You can use the ``atlas deployments logs`` command in the {+atlas-cli+}
81+
to retrieve deployment logs. To learn more,
82+
see :atlas:`Atlas Deployment Logs </cli/current/command/atlas-deployments-logs/>`.
83+
84+
Examples
85+
--------
86+
87+
The following examples show how to download logs and enable auditing
88+
using |service| :ref:`tools for automation <arch-center-automation>`.
89+
90+
In addition to the following examples, see the blogpost
91+
`Streamlining Log Management to Amazon S3 Using Atlas Push-based Log Exports With HashiCorp Terraform <https://www.mongodb.com/developer/products/atlas/streamlining-log-management-amazon-s3-atlas-push-based-log-exports-hashicorp-terraform/>`__.
3992

4093
.. tabs::
4194

4295
.. tab:: CLI
4396
:tabid: cli
4497

45-
Content here
98+
Download Logs
99+
~~~~~~~~~~~~~
100+
101+
Run the following CLI command to download a compressed file that contains the
102+
MongoDB logs for the specified host in your project.
103+
104+
.. include:: /includes/examples/cli-example-download-logs.rst
46105

47106
.. tab:: Terraform
48107
:tabid: Terraform
108+
109+
The following example demonstrates how to enable auditing for
110+
your deployment. Before you can create resources with Terraform,
111+
you must:
112+
113+
- :ref:`Create your paying organization <configure-paying-org>`
114+
and :ref:`create an API key <atlas-admin-api-access>` for the
115+
paying organization. Store your public and private keys as
116+
environment variables by running the following commands in the terminal:
117+
118+
.. code-block::
119+
120+
export MONGODB_ATLAS_PUBLIC_KEY="<insert your public key here>"
121+
export MONGODB_ATLAS_PRIVATE_KEY="<insert your private key here>"
122+
123+
- `Install Terraform <https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli>`__.
49124

50-
Content here
125+
Enable Auditing and Create an Auditing Filter for the {+Cluster+}
126+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
51127

128+
.. include:: /includes/examples/tf-example-auditing-filter.rst

‎source/includes/cloud-docs/logs.rst‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
You can download |service| logs at any point until the end of their
2+
retention periods by using the {+atlas-ui+}, {+atlas-admin-api+}, and
3+
{+atlas-cli+}. |service| retains the last 30 days of log messages and
4+
system event audit messages.
5+
6+
To learn more, see :ref:`mongodb-logs`.

‎source/includes/examples/tf-example-auditing-filter.rst‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
.. code-block:: shell
2+
:copyable: true
3+
4+
# Create a project
5+
resource "mongodbatlas_project" "project_test" {
6+
name = var.project_name
7+
org_id = var.org_id
8+
}
9+
10+
# Create a cluster with three nodes
11+
resource "mongodbatlas_advanced_cluster" "cluster_test" {
12+
project_id = mongodbatlas_project.project_test.id
13+
name = var.cluster_name
14+
cluster_type = "REPLICASET"
15+
16+
replication_specs {
17+
region_configs {
18+
priority = 7
19+
provider_name = "AWS"
20+
region_name = "US_EAST_1"
21+
electable_specs {
22+
instance_size = "M10"
23+
node_count = 3
24+
}
25+
}
26+
}
27+
}
28+
29+
# Specify an auditing resource and enable auditing for a project.
30+
# To configure auditing, specify the unique project ID. If you change
31+
# this value to a different "project_id", this deletes the current audit
32+
# settings for the original project.
33+
34+
# "audit_authorization_success" indicates whether the auditing system
35+
# captures successful authentication attempts for audit filters using
36+
# the "atype" : "authCheck" auditing event. Warning! If you set
37+
# "audit_authorization_success" to "true", this can severely impact
38+
# cluster performance. Enable this option with caution.
39+
40+
# "audit_filter" is the JSON-formatted audit filter.
41+
# "enabled" denotes whether or not the project associated with the
42+
# specified "{project_id}"" has database auditing enabled. Defaults to "false".
43+
44+
# Auditing created by API Keys must belong to an existing organization.
45+
46+
# In addition to arguments listed previously, the following attributes
47+
# are exported:
48+
49+
# "configuration_type" denotes the configuration method for the audit filter.
50+
# Possible values are:
51+
# - "NONE" - auditing is not configured for the project.
52+
# - "FILTER_BUILDER" - auditing is configured via the Atlas UI filter builder.
53+
# - "FILTER_JSON" - auditing is configured via a custom filter in Atlas or API.
54+
55+
resource "mongodbatlas_auditing" "test" {
56+
project_id = "mongodbatlas_project.project_test.id"
57+
audit_filter = "{ 'atype': 'authenticate', 'param': { 'user': 'auditAdmin', 'db': 'admin', 'mechanism': 'SCRAM-SHA-1' }}"
58+
audit_authorization_success = false
59+
enabled = true
60+
}

‎source/landing-zone.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ A landing zone is a well-architected and pre-configured environment for
3838
working in the cloud that conforms to your organization's unique
3939
requirements. A landing zone is often a prerequisite for enterprises to
4040
move workloads to the cloud, and it is is often provisioned
41-
programatically using an API or tools like Terraform.
41+
programmatically using an API or tools like Terraform.
4242

4343
An {+service+} landing zone defines how your team will work in
4444
{+service+}, including the internal settings and tools they should use,

‎source/monitoring-alerts.txt‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -334,12 +334,7 @@ To learn more, see :ref:`namespace-insights`.
334334
Recommendations for Monitoring by Using Logs
335335
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
336336

337-
You can download |service| logs at any point until the end of their
338-
retention periods by using the {+atlas-ui+}, {+atlas-admin-api+}, and
339-
{+atlas-cli+}. |service| retains the last 30 days of log messages and
340-
system event audit messages.
341-
342-
To learn more, see :ref:`mongodb-logs`.
337+
.. include:: /includes/cloud-docs/logs.rst
343338

344339
Examples
345340
--------

0 commit comments

Comments
 (0)