I am facing a problem with some data in my current database. There is a collection which is being populated and update through a NodeJS application. This collection possess a children which is an array of objects. I've observed this array gets some objects which I am not sure how they got there. I have traced the application and made sure this is not the culprit.

Therefore I would like to know if there is any way to know what user and host updated a collection and the data it used. Or to get the log of run queries against a collection.

I have used getLog but it's limited to 1024 characters so not that much to check there.

Edit 1 This is the config file:

# mongod.conf

# for documentation of all options, see:
#   http://docs.mongodb.org/manual/reference/configuration-options/

# Where and how to store data.
  dbPath: /var/lib/mongodb
    enabled: true
#  engine:
#  mmapv1:
#  wiredTiger:

# where to write logging data.
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

# network interfaces
  port: 27017

# how the process runs
  timeZoneInfo: /usr/share/zoneinfo





## Enterprise-Only Options:


  • You don not have the security (authentication and authorization) enabled. Users are created with specific authorizations/roles only when authorization is enabled. Note that application users/security is different from MongoDB database/server security.
    – prasad_
    Jul 23 at 1:28
  • You run your MongoDB without authentication, you should never do that! Actually why are you surprised that you got non-authorized access to your MongoDB? Jul 23 at 6:05
  • Unfortunately, I am only the developer of this system and I don't have any control over these things. But our concern is not about non-authorized accessess. The data being created happens always 2-3 seconds before the one being inserted by the application and it happens for specific type of records in that collection. Therefore this is not a non-authorized person inserting stuff. There must be some other system, part of the application or whatever inserting at the same time and I want to find what.
    – NeoChiri
    Jul 23 at 7:14

First thing you can check, who logged in to your MongoDB. Make a grep "Successful authentication" on your mongo logfile.

Then you can increase the logging level for commands, put this in your config file:

      verbosity: 1

Be aware, the log file may become big.

With the jq tool it would be similar to this:

jq -r 'select(.msg == "Successful authentication")' /var/log/mongodb/mongod.log

jq -r 'select(.c == "COMMAND")' /var/log/mongodb/mongod.log
  • Curiously, the log file is not created. I have added the config file as it is. We are using the docker image mongo:3.6
    – NeoChiri
    Jul 22 at 18:38
  • Hard to believe, because you configured log systemLog.path: /var/log/mongodb/mongod.log. How did you start the MongoDB? Did you set the config-file? Jul 23 at 6:07
  • The mongodb container is started through a docker compose. How to check if the config-file was set?
    – NeoChiri
    Jul 23 at 7:18
  • I am not familiar with docker. How is the mongod process started? Jul 23 at 7:38
  • It seems to start only by executing the command mongod
    – NeoChiri
    Jul 24 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.