How to view audit logs

Audit logging is enabled by default in Charmed MongoDB K8s.

You can view audit logs in two ways:

• via syslog
• via Grafana

View logs using syslog

The audit log is sent to syslog. You can check it by performing the following steps:

First, ssh to the relevant unit. For example:

juju ssh --container=mongod mongodb-k8s/0

In the unit’s shell, run:

tail -f /var/log/mongodb/audit.log

The console will now display audit log messages, for example:

Jan 26 13:22:56 juju-f6ba89-2 mongod: { "atype" : "updateOperation", "ts" : { "$date" : "2024-01-26T13:22:56.300+00:00" }, "local" : { "ip" : "10.55.47.232", "port" : 27017 }, "remote" : {}, "users" : [], "roles" : [], "param" : { "ns" : "local.replset.oplogTruncateAfterPoint", "doc" : { "_id" : "oplogTruncateAfterPoint", "oplogTruncateAfterPoint" : { "$timestamp" : { "t" : 1706275376, "i" : 1 } } } }, "result" : 0 }

View logs with Grafana

Audit logs can be viewed with grafana using the Canonical Observability Stack.

To view these logs, you must first integrate Charmed MongoDB K8s with the Canonical Observability Stack. Follow the instructions in How-To > View metrics in the section titled “Accessing metrics with Grafana”.

Once Grafana is active and you are able to access the GUI, navigate to the logging section. There you will be able to see your audit log messages.