MongoDB Connector

// Connect to MongoDB as admin
use admin

// Create a dedicated audit user with minimal privileges
db.createUser({
  user: "dbaudit_reader",
  pwd: "your_secure_password",
  roles: [
    { role: "clusterMonitor", db: "admin" },
    { role: "read", db: "admin" },
    { role: "read", db: "local" }
  ]
})

// Grant read access to each database you want to audit
use your_database
db.grantRolesToUser("dbaudit_reader", [
  { role: "read", db: "your_database" }
])

// Enable profiler on each database to audit
use your_database

// Level 1: Log slow operations only (recommended for production)
db.setProfilingLevel(1, { slowms: 100 })

// Level 2: Log all operations (use with caution in production)
db.setProfilingLevel(2)

// Verify profiler status
db.getProfilingStatus()

// View recent profiled operations
db.system.profile.find().sort({ ts: -1 }).limit(10)

databases:
  - name: production-mongodb
    type: mongodb
    host: mongodb.example.com
    port: 27017
    database: admin  # Auth database
    username: dbaudit_reader
    password: ${MONGODB_PASSWORD}

    # SSL/TLS Configuration (recommended for production)
    ssl: true
    ssl_ca_cert: /etc/dbaudit/certs/ca.pem
    ssl_allow_invalid_hostnames: false

    # Replica Set (if applicable)
    replica_set: rs0

    # Connection settings
    connect_timeout: 10000
    server_selection_timeout: 30000

    # Monitoring options
    options:
      profiler_level: 1
      slow_op_threshold_ms: 100
      track_queries: true
      track_connections: true
      track_indexes: true

# Test connection with mongosh
mongosh "mongodb://dbaudit_reader:your_password@mongodb.example.com:27017/admin"

# Test with TLS
mongosh "mongodb://dbaudit_reader:your_password@mongodb.example.com:27017/admin" --tls --tlsCAFile ca.pem

# Verify permissions
db.runCommand({ connectionStatus: 1, showPrivileges: true })

# Verify DB Audit collector can connect
dbaudit-collector test-connections --config /etc/dbaudit/config.yaml