If you haven't configured any extra logging, profiling, or auditing in advance, the default MongoDB log level will only include limited information such as connections, slow commands, and database drops rather than details of every command that was run. Logging every command will add significant write overhead for an active deployment.
However, assuming you have retained sufficient logs (and haven't suppressed connection information with the
quiet logging mode), you should be able to identify when your server was restarted without authentication as well as the remote IPs that connected. You'll have to
grep or parse available information out of the MongoDB log file(s).
Some example log search strings that might help construct a timeline of events:
[initandlisten] options -- shows the configuration options (such as authentication) used when your
mongod server is started (or restarted).
connection accepted from -- includes the IP address for remote clients as well as a connection ID (for example:
[conn123]) that you can use to find related log lines.
received client metadata -- provides (optional) client metadata (such as driver name and version) for a new connection.
dropDatabase -- indicates a database drop command was issued.
For a quick summary of IPs that connected you could also use
To mitigate future issues, please review the Security Checklist in the MongoDB documentation.