MongoDB Documentation, Release 3.0.4 { atype: <String>, ts : { "$date": <timestamp> }, local: { ip: <String>, port: <int> }, remote: { ip: <String>, port: <int> }, users : [ { user: <String>, db: <String> }, ... ], roles: [ { role: <String>, db: <String> }, ... ], param: <document>, result: <int> } The following table lists for each atype or action type, the associated param details and the result values, if any. 86 Enabling auditAuthorizationSuccess degrades performance more than logging only the authorization failures. 425 6.4. Security Reference atype param result authenticate { user: <user name>, db: <database>, mechanism: <mechanism> } 0 - Success 18 - Authentication Failed authCheck { command: <name>, ns: <database>.<collection>, args: <command object> } ns field is optional. args field may be redacted. 0 - Success 13 - Unauthorized to perform the op- eration. By default, the auditing system logs only the authorization fail- ures. To enable the system to log authorization successes, use the auditAuthorizationSuccess parameter. 86 Continued on next page Audit Event Actions, Details, and Results field String atype Action type. See Audit Event Actions, Details, and Results (page 425). field document ts Document that contains the date and UTC time of the event, in ISO 8601 format. field document local Document that contains the local ip address and the port number of the running instance. field document remote Document that contains the remote ip address and the port number of the incoming connection associated with the event. field array users Array of user identification documents. Because MongoDB allows a session to log in with different user per database, this array can have more than one user. Each document contains a user field for the username and a db field for the authentication database for that user. field array roles Array of documents that specify the roles (page 324) granted to the user. Each document contains a role field for the name of the role and a db field for the database associated with the role. field document param Specific details for the event. See Audit Event Actions, Details, and Results (page 425). field integer result Error code. See Audit Event Actions, Details, and Results (page 425).