...
In both textfile and bsonfile formats of the audit log, a createIndex action is logging more than just the index spec where only the index spec should be. Here is the line from the textfile: 013-10-28T11:26:27.256-0400 user2@db1,user8Ӝ@db7Ж 127.0.0.1:55833/127.0.0.1:27017 000000000000000000000000.0 Created index indexname11ب on db7Ж.c9ֆ as { v: 1, ns: "db7Ж.c9ֆ", name: "indexname11ب", key: { fld10: 1 } }. And here is the line from the bsonfile (represented as a python unicode dict): {u'remote': {u'ip': u'127.0.0.1', u'port': 55831}, u'users': [{u'userSource': u'db1', u'user': u'user2'}, {u'userSource': u'db7\u0416', u'user': u'user8\u04dc'}], u'atype': u'createIndex', u'ts': datetime.datetime(2013, 10, 28, 15, 26, 5, 619000, tzinfo=), u'param': {u'ns': u'db7\u0416.c9\u0586', u'indexName': u'indexname11\u0628', u'key': {u'ns': u'db7\u0416.c9\u0586', u'name': u'indexname11\u0628', u'key': {u'fld10': 1}, u'v': 1}}, u'result': 0, u'local': {u'ip': u'127.0.0.1', u'port': 27017}, u'id': {u'opnum': 0, u'connid': ObjectId('000000000000000000000000')}} In both cases, a larger object containing the index spec is logged. In other words, the following is being logged: { v: 1, ns: "db7Ж.c9ֆ", name: "indexname11ب", key: { fld10: 1 } } When the following should be logged instead: { fld10: 1 }
milkie commented on Mon, 28 Oct 2013 21:07:00 +0000: We should probably come up with a different term for this then. This is the full index specification, which is more than just the keys. I figured it will be important to the audit log consumers to include all the flags that the ensureIndex() contained. tim.olsen@10gen.com commented on Mon, 28 Oct 2013 20:31:38 +0000: Ok, I was a little confused with what an index spec is. The following page seems to say that an "index specification document" is the key: http://docs.mongodb.org/manual/reference/method/db.collection.dropIndex/ Whereas it seems you're saying that an index spec is the same as an element in the array returned by db.COLLECTION.getIndexes() in the mongo shell. Is that correct? auto commented on Mon, 28 Oct 2013 19:03:08 +0000: Author: {u'username': u'dannenberg', u'name': u'matt dannenberg', u'email': u'matt.dannenberg@10gen.com'} Message: SERVER-11409 change the bson form of createIndex to use the fieldname indexSpec instead of key Branch: master https://github.com/10gen/mongo-enterprise-modules/commit/60ce5c868b177fa52feacb2abf60f69b3b42ec54 milkie commented on Mon, 28 Oct 2013 17:37:40 +0000: I changed the name of one of the bson format fields in the auditing spec, so bouncing back to Matt for a bit of code change. milkie commented on Mon, 28 Oct 2013 17:26:59 +0000: I believe the code behavior is correct; the spec is unclear and I will edit it for clarity now. We need to have all the fields in the index entry recorded because if we only record the key specification, we will lose other fields such as "unique".
Run mongodb enterprise at git commit 8a2bca9ecaa4a6b203a80d8432c7033036eb467b w/ audit logging turned on. Create an index.