[DOCS-3913] MMS OnPrem1.5: Document all supported audit events Created: 17/Aug/14  Updated: 16/Mar/15  Resolved: 27/Aug/14

Status: Closed
Project: Documentation
Component/s: Cloud Manager
Affects Version/s: None
Fix Version/s: v1.3.10, mms-1.5

Type: Task Priority: Major - P3
Reporter: Cailin Nelson Assignee: Sam Kleinman (Inactive)
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Participants:
Days since reply: 9 years, 24 weeks, 1 day ago

 Description   

Most audits are visible by all users by visiting the Activity Feed for a Group. Audits marked "admin-only" are only visible from Admin -> General -> Audits page.

User Audits

  • JOINED_GROUP
    • A user joined a Group
    • This audit is not supported if using LDAP authentication for MMS users
  • REMOVED_FROM_GROUP
    • A user was removed from a Group
  • INVITED_TO_GROUP
    • A user was invited to a Group
  • MULTI_FACTOR_AUTH_RESET_EMAIL_SENT_AUDIT - admin-only
    • A user requested and was sent an email with a link that will allow them to reset their 2FA
  • MULTI_FACTOR_AUTH_RESET_AUDIT - admin-only
    • A user reset their 2FA
  • MULTI_FACTOR_AUTH_UPDATED_AUDIT - admin-only
    • A user updated their 2FA using the form in "My Profile"
  • PASSWORD_RESET_EMAIL_SENT_AUDIT - admin-only
    • A user requested and was sent an email with a link that will allow them to reset their password
  • PASSWORD_RESET_AUDIT - admin-only
    • A user successfully reset their password via the "reset password" flow
  • PASSWORD_UPDATED_AUDIT - admin-only
    • A user successfully updated their password using the form in "My Profile"
  • USER_EMAIL_ADDRESS_CHANGED_AUDIT - admin-only
    • A user changed their email address
  • USER_ROLES_CHANGED_AUDIT
    • A users roles in a particular Group were changed
  • SUCCESSFUL_LOGIN_AUDIT - admin-only
    • A user successfully authenticated with their username and password
  • UNSUCCESSFUL_LOGIN_AUDIT - admin-only
    • A user entered a valid username, but an invalid password
  • ACCOUNT_LOCKED_AUDIT
    • A user was locked out due to manual action taken by the administrator, or due to account locking policies
  • ACCOUNT_UNLOCKED_AUDIT
    • A user's account was unlocked by the administrator
  • USER_CREATED_AUDIT - admin-only
    • A new user was created

Host Audits

  • DELETE_HOST_AUDIT
    • A host has been manually suppressed by a user
  • REACTIVATE_HOST_AUDIT
    • A host has been manually reactivated by a user
  • DEACTIVATE_HOST_AUDIT
    • A host has been deactivated by the system.
  • ADD_HOST_AUDIT
    • A new host has been added by a user, or auto-discovered by the system
  • UNDELETE_HOST_AUDIT
    • A previously suppressed host has been unsuppressed by a user
  • HIDE_AND_DISABLE_HOST_AUDIT
    • A host has been determined to be a duplicate by the system, and has been hidden
  • DB_PROFILER_ENABLE_AUDIT
    • Database profiling has been enabled for a host
  • DB_PROFILER_DISABLE_AUDIT
    • Database profiling data collection has been disabled by a host
  • HOST_IP_CHANGED_AUDIT
    • A change in IP address has been detected for a host

Alert Config Audits

  • ALERT_ACKNOWLEDGED_AUDIT
    • An open alert has been acknowledged by a user.
  • ALERT_UNACKNOWLEDGED_AUDIT
    • An open alert has been unacknowledged by a user.
  • ALERT_CONFIG_DISABLED_AUDIT
    • An alert configuration has been disabled
  • ALERT_CONFIG_ENABLED_AUDIT
    • An alert configuration has been enabled
  • ALERT_CONFIG_ADDED_AUDIT
    • An alert configuration has been added
  • ALERT_CONFIG_DELETED_AUDIT
    • An alert configuration has been deleted
  • ALERT_CONFIG_CHANGED_AUDIT
    • An alert configuration has been edited

Backup Audits

  • RS_STATE_CHANGED_AUDIT
    • Backup for a replica set is started, stopped or terminated by a user
  • CLUSTER_STATE_CHANGED_AUDIT
    • Backup for a cluster is started, stopped or terminated by a user
  • RESTORE_REQUESTED_AUDIT
    • A restore has been requested
  • SYNC_REQUIRED_AUDIT
    • A resync of a replica set or config server has been initiated by a user
  • CLUSTERSHOT_DELETED_AUDIT
    • A clustershot has been deleted by a user
  • SNAPSHOT_DELETED_AUDIT
    • A snapshot for a replica set has been deleted by a user
  • RS_CREDENTIAL_UPDATED_AUDIT
    • The authentication credentials for a replica set were updated by a user
  • CLUSTER_CREDENTIAL_UPDATED_AUDIT
    • The authentication credentials for a cluster were updated by a user
  • RS_BLACKLIST_UPDATED_AUDIT
    • The excluded namespaces for a replica set were updated by a user
  • CLUSTER_BLACKLIST_UPDATED_AUDIT
    • The excluded namespaces for a cluster were updated by a user
  • RS_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
    • The snapshot schedule for a replica set was updated by a user
  • CLUSTER_SNAPSHOT_SCHEDULE_UPDATED_AUDIT
    • The snapshot schedule for a cluster was updated by a user
  • CLUSTER_CHECKKPOINT_UPDATED_AUDIT
    • The checkpoint schedule for a cluster was updated by a user

Group Audits

  • GROUP_DELETED - admin-only
    • A Group was deleted
  • GROUP_CREATED
    • A new Group was created


 Comments   
Comment by Githook User [ 02/Sep/14 ]

Author:

{u'username': u'tychoish', u'name': u'Sam Kleinman', u'email': u'samk@10gen.com'}

Message: DOCS-3913: adding audit events page
Branch: next
https://github.com/10gen/mms-docs/commit/ced972b731a080123c3a9abdd38bce39bdf88da1

Comment by Githook User [ 27/Aug/14 ]

Author:

{u'username': u'tychoish', u'name': u'Sam Kleinman', u'email': u'samk@10gen.com'}

Message: DOCS-3913: adding audit events page
Branch: master
https://github.com/10gen/mms-docs/commit/ced972b731a080123c3a9abdd38bce39bdf88da1

Generated at Thu Feb 08 07:46:47 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.