I am facing a problem with some data in my current database. There is a collection which is being populated and update through a NodeJS application. This collection possess a children which is an array of objects. I've observed this array gets some objects which I am not sure how they got there. I have traced the application and made sure this is not the culprit.

Therefore I would like to know if there is any way to know what user and host updated a collection and the data it used. Or to get the log of run queries against a collection.

I have used getLog but it's limited to 1024 characters so not that much to check there.

Edit 1 This is the config file:

# mongod.conf

# for documentation of all options, see:
#   http://docs.mongodb.org/manual/reference/configuration-options/

# Where and how to store data.
  dbPath: /var/lib/mongodb
    enabled: true
#  engine:
#  mmapv1:
#  wiredTiger:

# where to write logging data.
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

# network interfaces
  port: 27017

# how the process runs
  timeZoneInfo: /usr/share/zoneinfo





## Enterprise-Only Options:


  • Unfortunately, I am only the developer of this system and I don't have any control over these things. But our concern is not about non-authorized accessess. The data being created happens always 2-3 seconds before the one being inserted by the application and it happens for specific type of records in that collection. Therefore this is not a non-authorized person inserting stuff. There must be some other system, part of the application or whatever inserting at the same time and I want to find what.
    – NeoChiri
    Commented Jul 23, 2021 at 7:14

1 Answer 1


First thing you can check, who logged in to your MongoDB. Make a grep "Successful authentication" on your mongo logfile.

Then you can increase the logging level for commands, put this in your config file:

      verbosity: 1

Be aware, the log file may become big.

With the jq tool it would be similar to this:

jq -r 'select(.msg == "Successful authentication")' /var/log/mongodb/mongod.log

jq -r 'select(.c == "COMMAND")' /var/log/mongodb/mongod.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.