|
Open question, how should operations that span multiple mongo nodes leave audit trails on those nodes? Particularly if the operation is somehow lazy. For example, if a client sends an insert operation to a mongos and that triggers a collection to be created on a mongod, how shall that be logged to the audit logs on the mongos and mongod? What if the collection already exists as a sharded collection, but because no data was present on one of the shard servers previously, the collection must now be created on that shard? Does that get an audit entry? As the user that originally created the collection, the current user doing the write, the system user? Is it logged in the mongos's audit log, the shard server's audit log, or the config server's audit log?
For replication, should replicated operations be logged in every set members audit logs, only the primary's audit logs, or other?
Should audit information be written to local files at all, or should they be sent to an audit service (or database) instead?
|