Dear all,
We are using Percona Server for MongoDB 4.4.13 and within our server, auditing is active. The system logs almost everything perfectly but we have two problems which may caouse serious trouble against official regulatory audit.
In write operations, we can not see the details of the operation. For example; in an update operation such; db.getCollection(‘COLLECTION’).updateOne({_id:“197”}, {$set: {FieldName:“1” }}) the audit log include timestamp, the user, the collection name, the “update” command. But the missing part is the {$set: {FieldName:“1” }} whch means what is updated. A a result, we are unable to provide solid proof to official regulatory audits. We would appreciate if anyone can help us.
The log is;
{ “atype” : “authCheck”, “ts” : { “$date” : “2023-07-12T16:29:44.224+03:00” }, “local” : { “ip” : “127.0.1.1”, “port” : 27017 }, “remote” : { “ip” : “CLIENT_IP”, “port” : 64767 }, “users” : [ { “user” : “DBA_USER”, “db” : “admin” } ], “roles” : [ { “role” : “root”, “db” : “admin” } ], “param” : { “command” : “update”, “ns” : “DATABASE.COLLECTION”, “args” : { “update” : “COLLECTION”, “ordered” : true, “lsid” : { “id” : { “$binary” : “husM1jiGSjCQJTIUOPO0Zw==”, “$type” : “04” } }, “$clusterTime” : { “clusterTime” : { “$timestamp” : { “t” : 1689168565, “i” : 7 } }, “signature” : { “hash” : { “$binary” : “UzBeH2eAjOJZfeWcAQaLkVQaSHY=”, “$type” : “00” }, “keyId” : { “$numberLong” : “7209318063370403841” } } }, “$readPreference” : { “mode” : “secondaryPreferred” }, “$db” : “DATABASE” } }, “result” : 0 }
The second problem is; auditing logs successful authentication as “atype : authentication” and “result : 0”. But accoring to all documents provided, authentication failures should be logged as “result : 18” as well. We are using Studio3T, using a wrong password and creating an authentication failure but yet still the system does not log this failed authentication event into the audit.json file. Interestingly, we can see the authentication failure log within mongod.log file which we do not prefer as we are sending only audit.json file(s) to SIEM system.
Below you can see our mongo audit config;
auditLog:
destination: file
format: JSON
path: /var/log/mongodb/audit.json
filter: ‘{ “users”: { $exists: true, $not: {$size: 0} }, “users.user”: { $nin: [“serviceaccount1”, “serviceaccount2”, “automationAccount”, “__system”, “monitoringAccount”, “backupAccount”] } }’
setParameter: { auditAuthorizationSuccess: true }
