Uploaded image for project: 'Percona Server for MongoDB'
  1. Percona Server for MongoDB
  2. PSMDB-979

Audit log rotation behaviour on PSMDB 4.4.9-10

Details

    • Bug
    • Status: Done
    • Medium
    • Resolution: Fixed
    • 4.4.9-10
    • 4.4.14-14, 4.2.20-20
    • None
    • None
    • Yes
    • Yes

    Description

      Hi,

      I have audit enabled in a cluster (3 nodes) running PSMDB 4.4.9-10.

      Part of my mongod.conf

      systemLog:
        destination: file
        logAppend: true
        logRotate: reopen
        path: /var/log/mongodb/mongod.log
      
      auditLog:
        destination: file
        format: JSON
        path: /datadrive/mongodb/audit/audit.json
        filter: '{"$or": [{"users": [],"param.command": [{ $ne: "isMaster" }, { $ne: "ping" }] }, { "atype" : { $in: [ "authCheck", "authentication" ] }, "users.user" : /[a-zA-Z]+\\.[a-zA-Z]+/}]}'
      

      I’m using /etc/logrotate.d/mongodb to rotate mongod.conf:

      /var/log/mongodb/mongod.log {
        daily
        size 50M
        rotate 10
        missingok
        compress
        delaycompress
        notifempty
        create 640 mongod mongod
        sharedscripts
        postrotate
          /bin/kill -SIGUSR1 $(cat /var/run/mongod.pid 2>/dev/null) >/dev/null 2>&1
        endscript
      }
      

      When MongoDB rotates the mongod.log, the audit log is also rotated.

      If auditing is enabled, the logRotate command also rotates the audit log.

      However, although I have logRotate: reopen specified in the mongod.conf and this mechanism is used to rotate mongod.log, for the audit log, files like audit.json.<YYYY><mm><DD>T<HH><MM><SS> are created, which suggests that MongoDB is using the rename mechanism to rotate the audit logs instead of using the same mechanism used to rotate mongod.log, the one specified in mongod.conf, as it is stated in the documentation:

      If auditing is enabled, the logRotate command also rotates the audit log according to the above parameters. For example, if systemLog.logRotate is set to rename , the audit log will also be renamed.

      https://docs.mongodb.com/v4.4/reference/configuration-options/#mongodb-setting-systemLog.logRotate

      I opened a discussion with this same content in the Percona Community Forum and I was advised to create a ticket as this seems to be a bug https://forums.percona.com/t/audit-log-rotation-on-psmdb/13865. Can you please investigate?

       

      Thanks in advance.
      Kind regards,
      João Soares

      Attachments

        Activity

          People

            konstantin.trushin Konstantin Trushin
            joaorpsoares João Soares
            Igor Solodovnikov Igor Solodovnikov
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Smart Checklist