Docs Home → MongoDB Ops Manager
Audit Events
On this page
Ops Manager maintains an audit log of key operations that users and administrators perform in the system. Unless otherwise stated, the Audits page aggregates and displays these events. You can access the Audits page through the Admin link.
User Audit Events
JOINED_GROUPA user joined a Project.
This audit is not supported if using LDAP authentication for Ops Manager users
REMOVED_FROM_GROUPA user was removed from a Project.
INVITED_TO_GROUPA user was invited to a Project
MULTI_FACTOR_AUTH_RESET_EMAIL_SENT_AUDITA user requested and was sent an email with a link that will allow them to reset their 2 factor authentication.
MULTI_FACTOR_AUTH_RESET_AUDITA user reset their two factor authentication.
MULTI_FACTOR_AUTH_UPDATED_AUDITA user updated their 2FA using the form in My Profile.
PASSWORD_RESET_EMAIL_SENT_AUDITA user requested and was sent an email with a link that will allow them to reset their password.
PASSWORD_RESET_AUDITA user successfully reset their password via the reset password flow.
PASSWORD_UPDATED_AUDITA user successfully updated their password using the form in My Profile.
USER_EMAIL_ADDRESS_CHANGED_AUDITA user changed their email address.
USER_ROLES_CHANGED_AUDITA user's roles in a particular Project were changed.
SUCCESSFUL_LOGIN_AUDITA user successfully authenticated with their username and password.
UNSUCCESSFUL_LOGIN_AUDITLogin attempt was unsuccessful.
ACCOUNT_LOCKED_AUDITOps Manager locked a user's account from the system, as a result of manual action by the administrator, or because of a change in account locking policies.
ACCOUNT_UNLOCKED_AUDITAn administrator unlocked a user's account.
USER_CREATED_AUDITA new user was created.
Host Audit Events
DELETE_HOST_AUDITA host was suppressed by a user.
ADD_HOST_AUDITA new host was added by a user, or auto-discovered by the system.
UNDELETE_HOST_AUDITA previously suppressed host was un-suppressed by a user.
HIDE_AND_DISABLE_HOST_AUDITThe system determined that a host was a duplicate by the system, and hid that host from the interface.
DB_PROFILER_ENABLE_AUDITDatabase profiling was enabled for a host
DB_PROFILER_DISABLE_AUDITDatabase profiling data collection was disabled for a host
HOST_IP_CHANGED_AUDITA change in IP address was detected for a host.
Alert Config Audit Events
ALERT_ACKNOWLEDGED_AUDITA user acknowledged an open alert.
ALERT_UNACKNOWLEDGED_AUDITA user un-acknowledged an open alert.
ALERT_CONFIG_DISABLED_AUDITAn alert configuration was disabled.
ALERT_CONFIG_ENABLED_AUDITAn alert configuration was enabled.
ALERT_CONFIG_ADDED_AUDITAn alert configuration was added.
ALERT_CONFIG_DELETED_AUDITAn alert configuration was deleted.
ALERT_CONFIG_CHANGED_AUDITAn alert configuration was edited.
Backup Audit Events
RS_STATE_CHANGED_AUDITA user started, stopped, or terminated backup for a replica set. is started, stopped. or terminated by a user
CLUSTER_STATE_CHANGED_AUDITA user started, stopped or terminated backup for a sharded cluster.
RESTORE_REQUESTED_AUDITA restore was requested.
SYNC_REQUIRED_AUDITA user initiates a resync of a replica set or config server.
CLUSTERSHOT_DELETED_AUDITA user deletes a clustershot (e.g. a cluster checkpoint.)
SNAPSHOT_DELETED_AUDITA user delted a snapshot for a replica set.
RS_CREDENTIAL_UPDATED_AUDITA user updates the authentication credentials for a replica set.
CLUSTER_CREDENTIAL_UPDATED_AUDITA user updates the authentication credentials for a sharded cluster.
RS_BLACKLIST_UPDATED_AUDITA user updates the namespaces filter for a replica set.
CLUSTER_BLACKLIST_UPDATED_AUDITA user updates the namespaces filter for a sharded cluster.
RS_SNAPSHOT_SCHEDULE_UPDATED_AUDITA user updates the snapshot schedule for a replica set.
CLUSTER_SNAPSHOT_SCHEDULE_UPDATED_AUDITA user updates the snapshot schedule for a sharded cluster.
CLUSTER_CHECKKPOINT_UPDATED_AUDITA user updates the checkpoint schedule for a sharded cluster.
Project Audit Events
GROUP_DELETEDA Project was deleted.
GROUP_CREATEDA new Project was created.
FLUSHEDAll components of a deleted Project were removed from Ops Manager.
Usage Audit Events
These events are only displayed to users with the
Global Owner role.
USAGE_DATA_ENABLEDUsage data was enabled.
USAGE_DATA_DISABLEDUsage data was disabled.
USAGE_DATA_RAW_DOWNLOADUnencrypted data was downloaded.
Deployment Configuration Audit Events
AUTOMATION_CONFIG_PUBLISHED_AUDITAn Ops Manager setting was changed.
Note
Only the first setting changed is displayed. To see the full set of changes, click the view all changes link.
Data Explorer Events
DATA_EXPLORERA user performed a Data Explorer read operation.
DATA_EXPLORER_CRUDA user performed a Data Explorer operation which modified data.