storage: dbPath: data/db security: authorization: enabled auditLog: destination: file format: BSON path: data/db/auditLog.bson filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test\\./ } }' { atype: "authenticate", "param.db": "test" } To specify an audit filter, enclose the filter document in single quotes to pass the document as a string. mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ atype: "authenticate", To specify the audit filter in a configuration file , you must use the YAML format of the configuration file. To filter on all authenticate operations across databases, use the filter { atype: "authenticate" } . storage: dbPath: data/db security: authorization: enabled auditLog: destination: file format: BSON path: data/db/auditLog.bson filter: '{ atype: "authenticate", "param.db": "test" }' Filter on Collection Creation and Drop Operations for a Single Database The <field> can include any field in the audit message (page 424). For collection creation and drop operations (i.e. atype: "createCollection" and atype: "dropCollection" ), the audit messages include a namespace ns field in the param document. The following example audits only the createCollection and dropCollection operations that occur against the test database by using the filter: Note: The regular expression requires two backslashes ( \\ ) to escape the dot ( . ). To specify an audit filter, enclose the filter document in single quotes to pass the document as a string. { atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test \\ ./ } } mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ atype: { $in: [ To specify the audit filter in a configuration file , you must use the YAML format of the configuration file. Filter by Authorization Role The following example audits operations by users with readWrite (page 406) role on the test database, including users with roles that inherit from readWrite (page 406), by using the filter: { roles: { role: "readWrite", db: "test" } } To specify an audit filter, enclose the filter document in single quotes to pass the document as a string. mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ roles: { role: To specify the audit filter in a configuration file , you must use the YAML format of the configuration file. 401 6.3. Security Tutorials MongoDB Documentation, Release 3.0.4