MongoDB should be able to direct information about the following types of events to a text file or other target, for customer use in auditing user activity:

• DDL operations
  • Create/delete database
  • Create/delete collection
  • Create/delete index
  • Add/remove user
  • Alter user
  • Shard collection?
• Authentication operations
  • Failed authentication
  • Successful authentication
  • Logout
• Authorization Operations
  • Access denied for DDL operations
  • Access denied for CRUD operations?
  • Access denied for queries?

Audit log messages should include the user performing the successful action, a timestamp, and description of the action itself.