MongoDB structured server log
MongoDB structured server log. Structured MongoDB diagnostic log object.
Source and collection
Configured mongod/mongos diagnostic log destination.
Record MongoDB version, verbosity and destination. Audit logging is a separate capability.
Native example and provenance
publisher documentation example. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — preformatted example 1
One complete record selected; values unchanged.
Download the exact sample · Offline research kit
SHA-256: c48e65cbf4fe58e9f35a258083827c171eca3ce47251815d7f7396ddec0f6fe7
{"t":{"$date":"2020-05-01T15:16:17.180+00:00"},"s":"I", "c":"NETWORK", "id":12345, "ctx":"listener", "svc": "R", "msg":"Listening on", "attr":{"address":"127.0.0.1"}}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
t.$date | str |
s | str |
c | str |
id | int |
ctx | str |
svc | str |
msg | str |
attr.address | str |
- t
- Extended JSON timestamp object.
- s
- Severity code.
- c
- Component.
- id
- Message identifier.
- attr
- Message-specific structured attributes.
Investigation uses
- Review component, severity, message ID and attributes.
- Correlate diagnostic events with authentication, query and audit records where available.
Validation boundaries
This publisher example demonstrates serialization; a diagnostic log is not a complete database audit trail.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.