자체 관리형 배포서버에서 감사 필터 구성

이 페이지의 내용

Audit Filter Syntax
Filter Configuration at Runtime
Filter Configuration at System Startup
예시
자세히 알아보기

MongoDB 5.0 은(는) 2024 10월을 기준으로 수명이 종료됩니다. 이 버전의 문서는 더 이상 지원되지 않습니다. 6.0 배포서버 업그레이드 5.0 하려면 MongoDB 업그레이드 절차를 참조하세요.

참고

MongoDB Atlas에서의 감사

MongoDB Atlas supports auditing for all M10 and larger clusters. Atlas supports specifying a JSON-formatted audit filter as documented below and using the Atlas audit filter builder for simplified auditing configuration. To learn more, see the Atlas documentation for Set Up Database Auditing and Configure a Custom Auditing Filter.

MongoDB Enterprise supports auditing of various operations. When enabled, the audit facility, by default, records all auditable operations as detailed in Audit Event Actions, Details, and Results. You can specify event filters to limit which events are recorded.

You can configure audit filters at startup or you can configure MongoDB to allow filter configuration at runtime.

Audit Filter Syntax

Audit filters have the same form as query predicate documents specified to find commands. To see example audit filters, see 예시.

Filter Configuration at Runtime

MongoDB 5.0부터 mongod 및 mongos 노드에 대한 감사 구성은 런타임에 구성할 수 있습니다. 이러한 노드 그룹은 분산 감사 구성에 참여할 수 있습니다.

분산 감사 구성에 노드를 포함하려면 다음과 같이 노드의 구성 파일을 업데이트하고 서버를 다시 시작합니다.

Parameter	값
`auditLog.runtimeConfiguration`	`true`
`auditLog.filter`	Unset
`auditAuthorizationSuccess`	Unset

다음과 같은 경우 서버는 오류를 기록하고 시작되지 않습니다.

runtimeConfiguration이 true이고
{22}} 또는 auditAuthorizationSuccess가 설정됩니다.

런타임에 감사 필터 및 auditAuthorizationSuccess 매개 변수를 수정하려면 setAuditConfig를 참조하세요.

Filter Configuration at System Startup

Audit filters can be specified on the command line or else in the 구성 파일 used to start the mongod or mongos instance.

Configuration File Usage

Filters can be specified in YAML under the auditLog session of the 구성 파일. See the examples below for sample configurations.

참고

If runtimeConfiguration is enabled, then the 구성 파일 cannot be used to specify audit filters.

예시

Record All Auditable Events

To record all auditable events, do not specify an audit filter. By default, the audit facility records all auditable operations.

Filter for Multiple Operation Types

The following example audits only the createCollection and dropCollection actions by using the filter:

{ atype: { $in: [ "createCollection", "dropCollection" ] } }

감사 필터를 지정하려면 필터 문서를 작은따옴표 안에 입력하고 문서를 문자열로 전달합니다.

mongod --dbpath data/db --auditDestination file --auditFilter '{ atype: { $in: [ "createCollection", "dropCollection" ] } }' --auditFormat BSON --auditPath data/db/auditLog.bson

구성에 필요한 추가 옵션을 포함합니다. 예를 들어 원격 클라이언트를 배포에 연결하거나 배포 구성원이 다른 호스트에서 실행되도록 하려면 --bind_ip 를 지정합니다.

To specify the audit filter in a 구성 파일, you must use the YAML format of the configuration file.

storage:
   dbPath: data/db
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] } }'

Filter on Authentication Operations on a Single Database

The <field> can include any field in the audit message. For authentication operations (i.e. atype: "authenticate"), the audit messages include a db field in the param document.

The following example audits only the authenticate operations that occur against the test database by using the filter:

{ atype: "authenticate", "param.db": "test" }

감사 필터를 지정하려면 필터 문서를 작은따옴표 안에 입력하고 문서를 문자열로 전달합니다.

mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ atype: "authenticate", "param.db": "test" }' --auditFormat BSON --auditPath data/db/auditLog.bson

To specify the audit filter in a 구성 파일, you must use the YAML format of the configuration file.

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: "authenticate", "param.db": "test" }'

To filter on all authenticate operations across databases, omit "param.db": "test" and use the filter { atype: "authenticate" }.

Filter on Collection Creation and Drop Operations for a Single Database

The <field> can include any field in the audit message. For collection creation and drop operations (i.e. atype: "createCollection" and atype: "dropCollection"), the audit messages include a namespace ns field in the param document.

The following example audits only the createCollection and dropCollection operations that occur against the test database by using the filter:

참고

The regular expression requires two backslashes (\\) to escape the dot (.).

{ atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test\\./ } }

감사 필터를 지정하려면 필터 문서를 작은따옴표 안에 입력하고 문서를 문자열로 전달합니다.

mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test\\./ } }' --auditFormat BSON --auditPath data/db/auditLog.bson

To specify the audit filter in a 구성 파일, you must use the YAML format of the configuration file.

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: { $in: [ "createCollection", "dropCollection" ] }, "param.ns": /^test\\./ } }'

Filter by Authorization Role

The following example audits operations by users with readWrite role on the test database, including users with roles that inherit from readWrite, by using the filter:

{ roles: { role: "readWrite", db: "test" } }

감사 필터를 지정하려면 필터 문서를 작은따옴표 안에 입력하고 문서를 문자열로 전달합니다.

mongod --dbpath data/db --auth --auditDestination file --auditFilter '{ roles: { role: "readWrite", db: "test" } }' --auditFormat BSON --auditPath data/db/auditLog.bson

To specify the audit filter in a 구성 파일, you must use the YAML format of the configuration file.

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ roles: { role: "readWrite", db: "test" } }'

Filter on Read and Write Operations

To capture read and write operations in the audit, you must also enable the audit system to log authorization successes using the auditAuthorizationSuccess parameter. [1]

참고

Enabling auditAuthorizationSuccess degrades performance more than logging only the authorization failures.

This filter audits multiple read and write operations:

{
   atype: "authCheck",
   "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] }
}

The audited operations include:

감사 필터를 지정하려면 필터 문서를 작은따옴표 안에 입력하고 문서를 문자열로 전달합니다.

mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFilter '{ atype: "authCheck", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }' --auditFormat BSON --auditPath data/db/auditLog.bson

To specify the audit filter in a 구성 파일, you must use the YAML format of the configuration file.

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: "authCheck", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }'
setParameter: { auditAuthorizationSuccess: true }

Filter on Read and Write Operations for a Collection

To capture read and write operations in the audit, you must also enable the audit system to log authorization successes using the auditAuthorizationSuccess parameter. [1]

참고

Enabling auditAuthorizationSuccess degrades performance more than logging only the authorization failures.

This filter audits multiple read and write operations on the orders collection in the test database:

{
    atype: "authCheck",
    "param.ns": "test.orders",
    "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] }
}

The audited operations include:

감사 필터를 지정하려면 필터 문서를 작은따옴표 안에 입력하고 문서를 문자열로 전달합니다.

mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFilter '{ atype: "authCheck", "param.ns": "test.orders", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }' --auditFormat BSON --auditPath data/db/auditLog.bson

To specify the audit filter in a 구성 파일, you must use the YAML format of the configuration file.

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ atype: "authCheck", "param.ns": "test.orders", "param.command": { $in: [ "find", "insert", "delete", "update", "findAndModify" ] } }'
setParameter: { auditAuthorizationSuccess: true }

Specify Top-Level Query Operators ($or)

To filter on multiple audit message fields, you can specify a top-level query operator like $or. For example, the following filter captures operations where either atype is authenticate or the operation was performed by a user with the readWrite role:

{
   $or: [
      { atype: "authenticate" },
      { "roles.role": "readWrite" }
   ]
}

감사 필터를 지정하려면 필터 문서를 작은따옴표 안에 입력하고 문서를 문자열로 전달합니다.

mongod --dbpath data/db --auth --setParameter auditAuthorizationSuccess=true --auditDestination file --auditFilter '{ $or: [ { atype: "authenticate" }, { "roles.role": "readWrite" } ] }' --auditFormat BSON --auditPath data/db/auditLog.bson

To specify the audit filter in a 구성 파일, you must use the YAML format of the configuration file.

storage:
   dbPath: data/db
security:
   authorization: enabled
auditLog:
   destination: file
   format: BSON
   path: data/db/auditLog.bson
   filter: '{ $or: [ { atype: "authenticate" }, { "roles.role": "readWrite" } ] }'

자세히 알아보기

[1]	(1, 2) You can enable `auditAuthorizationSuccess` parameter without enabling `--auth`; however, all operations will return success for authorization checks.

돌아가기

구성

감사 메시지