System Event Audit Messages in Self-Managed Deployments

When the MongoDB auditing facility captures events, you can specify the schema that MongoDB uses for log message output:

• The mongo schema writes logs in a format designed by MongoDB. This is the default log output schema.

• The OCSF schema writes logs in OCSF format. This option provides logs in a more widely-used standardized format compatible with log processors.

To set the schema used for log messages, use the auditLog.schema configuration file option.

For examples and details on the messages returned in each schema, see these pages:

• mongo Schema Audit Messages

• OCSF Schema Audit Messages