MongoDB Documentation, Release 3.0.4 Filter on Read and Write Operations To capture read and write operations in the audit, you must also enable the audit system to log authorization successes using the auditAuthorizationSuccess parameter. 75 Note: Enabling auditAuthorizationSuccess degrades performance more than logging only the authorization failures. The following example audits the find() , insert() , remove() , update() , save() , and findAndModify() operations by using the filter: { atype: "authCheck", "param.command": { $in: [ "find", "insert", "delete", "update", To specify an audit filter, enclose the filter document in single quotes to pass the document as a string. mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess= true -- To specify the audit filter in a configuration file , you must use the YAML format of the configuration file. storage: dbPath: data/db security: authorization: enabled auditLog: destination: file format: BSON path: data/db/auditLog.bson filter: '{ atype: "authCheck", "param.command": { $in: [ "find", "insert", "delete", setParameter: { auditAuthorizationSuccess: true } { atype: "authCheck", "param.ns": "test.orders", "param.command": { $in: [ "find", "insert", To specify an audit filter, enclose the filter document in single quotes to pass the document as a string. The following example audits the find() , insert() , remove() , update() , save() , and findAndModify() operations for the collection orders in the database test by using the filter: Note: Enabling auditAuthorizationSuccess degrades performance more than logging only the authorization failures. Filter on Read and Write Operations for a Collection To capture read and write operations in the audit, you must also enable the audit system to log authorization successes using the auditAuthorizationSuccess parameter. 1 storage: dbPath: data/db security: authorization: enabled auditLog: destination: file format: BSON path: data/db/auditLog.bson filter: '{ roles: { role: "readWrite", db: "test" } }' 75 You can enable auditAuthorizationSuccess parameter without enabling --auth ; however, all operations will return success for authorization checks. Chapter 6. Security 402