# Percona server for mongodb: docker image with auditing included

**URL:** <https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977>\
**Category:** Percona Distribution for MongoDB\
**Tags:** percona\
**Created:** [January 28, 2021, 10:33am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977 "2021-01-28T10:33:46Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anu\_Madan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anu_madan/32/2698_2.png) [@Anu\_Madan](https://forums.percona.com/u/Anu_Madan)\
**Post date:** [January 28, 2021, 10:33am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/1 "2021-01-28T10:33:46Z")

</div>

I am trying to enable audit logs on my psmdb instance but I do not see audit logs being created.  
I came across a readme, which mentions - “By default, when building Percona Server for MongoDB from source, audit functionality is neither compiled with, nor linked into, the final binary executable. To enable auditing, execute SCons with the `--audit` argument:”

I am using an official docker image ‘percona/percona-server-mongodb:4.4’ and have followed [Running Percona Server for MongoDB in a Docker Container — Percona Server for MongoDB 5.0 Documentation](https://www.percona.com/doc/percona-server-for-mongodb/LATEST/install/docker.html) for setting up my server.

Need help to find a relavant docker image which includes audit functionality.

Thanks,  
Anu

---

<div class="post-metadata">

**Author:** ![Evgeniy\_Patlan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/evgeniy_patlan/32/41_2.png) [@Evgeniy\_Patlan](https://forums.percona.com/u/Evgeniy_Patlan)\
**Post date:** [January 28, 2021, 10:47pm UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/2 "2021-01-28T22:47:04Z")

</div>

@Anu_Madan according to [Auditing - Percona Server for MongoDB 4.4](https://www.percona.com/doc/percona-server-for-mongodb/4.4/audit-logging.html)

> To enable audit logging, specify where to send audit events using the --auditDestination option on the command line or the auditLog.destination variable in the configuration file.

So if you want to pass params for mongod on upstart you should run docker in the following way:  
`docker run --name my-container-name -d percona/percona-server-mongodb --option1=value --option2=value`

So please replace option1 and so on with needed params

---

<div class="post-metadata">

**Author:** ![Akira\_Kurogane](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/akira_kurogane/32/1280_2.png) [@Akira\_Kurogane](https://forums.percona.com/u/Akira_Kurogane)\
**Post date:** [January 29, 2021, 2:29am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/3 "2021-01-29T02:29:00Z")

</div>

Thanks Evgeniy.

Hi Anu. As well as the _auditLog.destination_ config file option you will probably be interested in setting the _auditLog.filter_ option as well. I don’t mean there is a connection to mongodb being in docker, this is just a point about using MongoDB auditing in general. What audit events you do and don’t want to include in the audit log is up to you.

---

<div class="post-metadata">

**Author:** ![Anu\_Madan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anu_madan/32/2698_2.png) [@Anu\_Madan](https://forums.percona.com/u/Anu_Madan)\
**Post date:** [January 29, 2021, 5:11am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/4 "2021-01-29T05:11:20Z")

</div>

Thanks Evgeniy and Akira.  
I have defined all parameters as you have mentioned. I am using config file. Here is an excerpt from my mongod.conf:

```auto
auditLog:
  destination: file
  format: JSON
  path: /var/auditLog.json
setParameter: { auditAuthorizationSuccess: true }

```

I have not applied any filters to make sure at least some audit logs are generated. The operations tried were, create db, create collection, insert records, drop collection, drop db etc. but no audit logs were generated.

The docker was run in the following way:

```auto
docker run -d --name psmdb --restart always -v C:/IDX/percona/mongodb.conf:/etc/mongod.conf -v C:/IDX/percona/logs/audit.json:/var/audit.json --net eauthlocalnw percona/percona-server-mongodb:4.4 --config /etc/mongod.conf

```

Is there a specific parameter to be sent in the run command to enable audit?  
What else am I missing?

Thanks,  
Anu

---

<div class="post-metadata">

**Author:** ![Akira\_Kurogane](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/akira_kurogane/32/1280_2.png) [@Akira\_Kurogane](https://forums.percona.com/u/Akira_Kurogane)\
**Post date:** [January 29, 2021, 6:57am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/5 "2021-01-29T06:57:19Z")

</div>

Hi Anu.

> Is there a specific parameter to be sent in the run command to enable audit

Assuming there isn’t some YAML syntax error and the mongod was able to restart with that config the audit log should be working now.

I don’t recall the default audit filter’s exact value, but it is fairly broad. Creating and dropping a dummy collection as you tried should make them appear.

On a different topic: Unless you have a small database with very low traffic using _auditAuthorizationSuccess: true_ is an overly expensive performance hit. Writing an event to the audit log file is much, much slower than reading or updating a documents in the collections. On the order of 100 times slower. Save auditing for the purpose of catching DBA operations, not for logging access to collections by a user who was already granted access to those collections.

---

<div class="post-metadata">

**Author:** ![Anu\_Madan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anu_madan/32/2698_2.png) [@Anu\_Madan](https://forums.percona.com/u/Anu_Madan)\
**Post date:** [January 29, 2021, 7:07am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/6 "2021-01-29T07:07:04Z")

</div>

There is surely no YAML syntax error and mongod is started successfully. The file at /etc/mongod.conf correctly contains the auditLog configuration and I am able to do database operations successfully.  
But, Audit log file stays empty. No logs are generated.

One of the documents mention: " By default, operations with successful authorization are not logged, so for this filter to work, enable `auditAuthorizationSuccess` parameter". Hence I tried setting that to true but that also did not help.  
Currently, my objective is to get the audit log working irrespective of the performance.

Any more ideas will help.

Thanks,  
Anu

---

<div class="post-metadata">

**Author:** ![Akira\_Kurogane](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/akira_kurogane/32/1280_2.png) [@Akira\_Kurogane](https://forums.percona.com/u/Akira_Kurogane)\
**Post date:** [January 29, 2021, 8:18am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/7 "2021-01-29T08:18:44Z")

</div>

I see.

Well, maybe I’m mistaken about the filter being a match on all events (except authorizationSuccess: true sub-category) by default.

Here’s a explicit one to try:

```auto
    auditLog:
        destination: file
        path: /some/file/path
        filter: '{atype: {$in: [
         "authenticate", "authCheck",
         "renameCollection", "dropCollection", "dropDatabase",
         "createUser", "dropUser", "dropAllUsersFromDatabase", "updateuser",
         "grantRolesToUser", "revokeRolesFromUser", "createRole", "updateRole",
         "dropRole", "dropAllRolesFromDatabase", "grantRolesToRole", "revokeRolesFromRole",
         "grantPrivilegesToRole", "revokePrivilegesFromRole",
         "replSetReconfig",
         "enableSharding", "shardCollection", "addShard", "removeShard",
         "shutdown",
         "applicationMessage"
      ]}}'

```

The multiline-filter string within the single-quote escaped string is valid, but if you are worried it might get mangled it is fine to delete the line breaks.

---

<div class="post-metadata">

**Author:** ![Anu\_Madan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anu_madan/32/2698_2.png) [@Anu\_Madan](https://forums.percona.com/u/Anu_Madan)\
**Post date:** [January 29, 2021, 9:19am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/8 "2021-01-29T09:19:51Z")

</div>

Tried the suggested changes. Please see the snapshot.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/2X/f/f1ddc7931d4f47cebdacdc7c330882b72bfcd6cb.png)  
restarted the container for this to take effect and again performed the db operations - create db, collection, insert records, drop collection etc.  
No audit logs generated. audit.json is still a blank file.

-rwxrwxrwx 1 root root 0 Jan 29 09:16 audit.json

Thanks,  
Anu

---

<div class="post-metadata">

**Author:** ![Evgeniy\_Patlan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/evgeniy_patlan/32/41_2.png) [@Evgeniy\_Patlan](https://forums.percona.com/u/Evgeniy_Patlan)\
**Post date:** [January 29, 2021, 11:12am UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/9 "2021-01-29T11:12:42Z")

</div>

@Anu_Madan once you edit config file insede container - you want get your changes after the restart of container.  
You should put config file on your host system, modify it, and mount during docker run command.

---

<div class="post-metadata">

**Author:** ![Anu\_Madan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anu_madan/32/2698_2.png) [@Anu\_Madan](https://forums.percona.com/u/Anu_Madan)\
**Post date:** [January 29, 2021, 1:52pm UTC](https://forums.percona.com/t/percona-server-for-mongodb-docker-image-with-auditing-included/8977/10 "2021-01-29T13:52:52Z")

</div>

Thanks Evgeniy. The following entries in my mongod.config are causing some issue.

processManagement:  
fork: false  
pidFilePath: /var/run/mongod.pid

I debugged with removing each line from the config file one by one and zeroed on to this. Without these, I got a few logs in the auditlog file.

Thank you very much for your help.

-Anu