MongoDB Documentation, Release 3.0.4 bsondump data/db/auditLog.bson Configure Audit Filters (page 400), Auditing (page 330), System Event Audit Messages (page 424) MongoDB Enterprise 74 supports auditing (page 330) of various operations. When enabled (page 398), the audit facility, by default, records all auditable operations as detailed in Audit Event Actions, Details, and Results (page 425). To specify which events to record, the audit feature includes the --auditFilter option. --auditFilter Option The --auditFilter option takes a string representation of a query document of the form: { <field1>: <expression1>, ... } To specify an audit filter, enclose the filter document in single quotes to pass the document as a string. To specify the audit filter in a configuration file , you must use the YAML format of the configuration file. Filter for Multiple Operation Types The following example audits only the createCollection (page 419) and dropCollection (page 420) actions by using the filter: { atype: { $in: [ "createCollection", "dropCollection" ] } } To specify an audit filter, enclose the filter document in single quotes to pass the document as a string. mongod --dbpath data/db --auditDestination file --auditFilter '{ atype: { $in: [ "createCollection", To specify the audit filter in a configuration file , you must use the YAML format of the configuration file. Filter on Authentication Operations on a Single Database The <field> can include any field in the audit message (page 424). For authentication operations (i.e. atype: "authenticate" ), the audit messages include a db field in the param document. The following example audits only the authenticate operations that occur against the test database by using the filter: $^{74}$https://www.mongodb.com/products/mongodb-enterprise-advanced?jmp=docs Chapter 6. Security 400 • The <field> can be any field in the audit message (page 424), including fields returned in the param (page 425) document. • The <expression> is a query condition expression . Examples Configure Audit Filters See also: storage: dbPath: data/db auditLog: destination: file format: BSON path: data/db/auditLog.bson filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }'