MongoDB Documentation, Release 3.0.4 } ) The following tutorials provide instructions on how to enable auditing for system events and specify which events to audit. Configure System Events Auditing (page 398) Enable and configure MongoDB Enterprise system event auditing fea- ture. Configure Audit Filters (page 400) Specify which events to audit. Configure System Events Auditing 6.3.5 Auditing Tutorials New in version 2.6. MongoDB Enterprise 73 supports auditing (page 330) of various operations. A complete auditing solution must involve all mongod server and mongos router processes. The audit facility can write audit events to the console, the syslog (option is unavailable on Windows), a JSON file, or a BSON file. For details on the audited operations and the audit log messages, see System Event Audit Messages (page 424). Use the --auditDestination option to enable auditing and specify where to output the audit events. Warning: For sharded clusters, if you enable auditing on mongos instances, you must enable auditing on all mongod instances in the cluster, i.e. shards and config servers. Output to Syslog To enable auditing and print audit events to the syslog (option is unavailable on Windows) in JSON format, specify syslog for the --auditDestination setting. For example: mongod --dbpath data/db --auditDestination syslog Warning: The syslog message limit can result in the truncation of the audit messages. The auditing system will neither detect the truncation nor error upon its occurrence. $^{73}$https://www.mongodb.com/products/mongodb-enterprise-advanced?jmp=docs Enable and Configure Audit Output 398 Chapter 6. Security storage: dbPath: data/db auditLog: destination: syslog You may also specify these options in the configuration file :