How to view audit logs

You can view audit logs in two ways:

View logs with syslog

First, ssh to the relevant unit. For example:

juju ssh mongodb/leader

In the unit’s shell, run:

tail -f /var/log/syslog

The console will now display audit log messages, for example:

Jan 26 13:22:56 juju-f6ba89-2 mongod: { "atype" : "updateOperation", "ts" : { "$date" : "2024-01-26T13:22:56.300+00:00" }, "local" : { "ip" : "10.55.47.232", "port" : 27017 }, "remote" : {}, "users" : [], "roles" : [], "param" : { "ns" : "local.replset.oplogTruncateAfterPoint", "doc" : { "_id" : "oplogTruncateAfterPoint", "oplogTruncateAfterPoint" : { "$timestamp" : { "t" : 1706275376, "i" : 1 } } } }, "result" : 0 }

First, ssh to the relevant unit. For example:

juju ssh --container=mongod mongodb-k8s/0

In the unit’s shell, run:

tail -f /var/log/mongodb/audit.log

The console will now display audit log messages, for example:

Jan 26 13:22:56 juju-f6ba89-2 mongod: { "atype" : "updateOperation", "ts" : { "$date" : "2024-01-26T13:22:56.300+00:00" }, "local" : { "ip" : "10.55.47.232", "port" : 27017 }, "remote" : {}, "users" : [], "roles" : [], "param" : { "ns" : "local.replset.oplogTruncateAfterPoint", "doc" : { "_id" : "oplogTruncateAfterPoint", "oplogTruncateAfterPoint" : { "$timestamp" : { "t" : 1706275376, "i" : 1 } } } }, "result" : 0 }

View logs with Grafana

Audit logs can be viewed with grafana using COS (Canonical Observability Stack).

To view logs, you must first integrate Charmed MongoDB with COS. See: Access metrics with Grafana.

Once Grafana is active and you are able to access the GUI, navigate to the Logging section. There you will be able to see your audit log messages.