SERVER-16452 added client connection information to failed log in attempts, however unauthorised messages are bereft of any detail to make them immediately useful. For example:

2016-06-30T08:42:35.887+1000 I ACCESS   [conn1] Unauthorized: not authorized on test to execute command { insert: "test", documents: [ { 1: 1.0, _id: ObjectId('57744edb16608f349f2197fc') } ], ordered: true }

The message does not tell you which user failed the check, and also does not tell you which client/ip address the attempt came from (without back tracing in the logs).