0

For some reasons I disabled the user access control and somehow all collections have been wiped out. So I want an activity log to find out how this happened

I need a list like this:

|  Date/Time           |  IP           |  Command           |
|----------------------+---------------+--------------------|
|  2018/1/1  18:20:50  |  127.0.0.1    |  show collections  |
|  yyyy/m/d  hh:mm:ss  |  x.x.x.x      |  executed command  |
  • OS: Ubuntu 18.04
  • MongoDB: 3.6.3
2
1

If you haven't configured any extra logging, profiling, or auditing in advance, the default MongoDB log level will only include limited information such as connections, slow commands, and database drops rather than details of every command that was run. Logging every command will add significant write overhead for an active deployment.

However, assuming you have retained sufficient logs (and haven't suppressed connection information with the quiet logging mode), you should be able to identify when your server was restarted without authentication as well as the remote IPs that connected. You'll have to grep or parse available information out of the MongoDB log file(s).

Some example log search strings that might help construct a timeline of events:

  • [initandlisten] options -- shows the configuration options (such as authentication) used when your mongod server is started (or restarted).
  • connection accepted from -- includes the IP address for remote clients as well as a connection ID (for example: [conn123]) that you can use to find related log lines.
  • received client metadata -- provides (optional) client metadata (such as driver name and version) for a new connection.
  • dropDatabase -- indicates a database drop command was issued.

For a quick summary of IPs that connected you could also use mloginfo --connections.

To mitigate future issues, please review the Security Checklist in the MongoDB documentation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.