<section>
 <h1 class="contains-headerlink leafygreen-ui-41fr9s" weight="medium">
  System Event Audit Messages in Self-Managed Deployments
  <a class="headerlink leafygreen-ui-1kepx47" href="#system-event-audit-messages-in-self-managed-deployments" title="Permalink to this heading">
   <svg aria-label="Link Icon" class="leafygreen-ui-a30zj9" fill="none" height="12" role="img" viewbox="0 0 16 16" width="12" xmlns="http://www.w3.org/2000/svg">
    <path d="M6.039 9.953a3.596 3.596 0 0 1-.327-.38l1.45-1.445a1.553 1.553 0 0 0 2.496.423l2.885-2.87a1.57 1.57 0 0 0 .01-2.213 1.553 1.553 0 0 0-2.203-.01l-.379.377A.995.995 0 0 1 8.56 3.83a1.005 1.005 0 0 1 .006-1.418l.38-.377a3.542 3.542 0 0 1 5.024.023 3.58 3.58 0 0 1-.022 5.047l-2.884 2.871a3.542 3.542 0 0 1-5.025-.022Z" fill="currentColor">
    </path>
    <path d="M9.961 6.047c.12.12.228.248.327.38l-1.45 1.445a1.553 1.553 0 0 0-2.496-.423l-2.885 2.87a1.57 1.57 0 0 0-.01 2.213 1.553 1.553 0 0 0 2.203.01l.379-.377a.995.995 0 0 1 1.411.006 1.005 1.005 0 0 1-.006 1.418l-.38.377a3.542 3.542 0 0 1-5.024-.023 3.58 3.58 0 0 1 .022-5.047l2.884-2.871a3.542 3.542 0 0 1 5.025.022Z" fill="currentColor">
    </path>
   </svg>
   <div class="css-1btu0w3 evvkmar0" id="system-event-audit-messages-in-self-managed-deployments">
   </div>
  </a>
 </h1>
 <div class="leafygreen-ui-15mdk4" role="note">
  <h2 class="leafygreen-ui-6n7b7d">
   Note
  </h2>
  <div class="leafygreen-ui-9mycqc">
   <p class="leafygreen-ui-1kp3ins">
    System Event Audit Messages are available in
    <a class="leafygreen-ui-tqgtui" href="/docs/manual/administration/install-enterprise/#std-label-install-mdb-enterprise">
     MongoDB Enterprise
    </a>
    and
    <a class="lg-ui-0001 leafygreen-ui-fgcsv5" href="https://www.mongodb.com/docs/atlas/" target="_self">
     <span>
      MongoDB Atlas
      <!-- -->
      .
     </span>
    </a>
   </p>
   <p class="leafygreen-ui-1kp3ins">
    To learn more about this feature in MongoDB Atlas, see
the Atlas documentation for
    <a class="lg-ui-0001 leafygreen-ui-fgcsv5" href="https://www.mongodb.com/docs/atlas/database-auditing/#std-label-set-up-database-auditing" target="_self">
     <span>
      Set Up Database Auditing
     </span>
    </a>
    and
    <a class="lg-ui-0001 leafygreen-ui-fgcsv5" href="https://www.mongodb.com/docs/atlas/mongodb-logs/#std-label-mongodb-logs" target="_self">
     <span>
      View and Download MongoDB Logs
      <!-- -->
      .
     </span>
    </a>
   </p>
  </div>
 </div>
 <p class="leafygreen-ui-1kp3ins">
  When the MongoDB auditing facility captures events, you can specify the
schema that MongoDB uses for log message output:
 </p>
 <ul class="leafygreen-ui-rioki0">
  <li class="leafygreen-ui-d7p7b6">
   <p class="leafygreen-ui-1kp3ins">
    The
    <code class="leafygreen-ui-1l06pbn">
     mongo
    </code>
    schema writes logs in a format designed by MongoDB. This
is the default log output schema.
   </p>
  </li>
  <li class="leafygreen-ui-d7p7b6">
   <p class="leafygreen-ui-1kp3ins">
    The
    <code class="leafygreen-ui-1l06pbn">
     OCSF
    </code>
    schema writes logs in
    <span class="leafygreen-ui-vm4wms" tabindex="0">
     OCSF
    </span>
    format. This option
provides logs in a more widely-used standardized format compatible
with log processors.
   </p>
  </li>
 </ul>
 <p class="leafygreen-ui-1kp3ins">
  To set the schema used for log messages, use the
  <a class="leafygreen-ui-tqgtui" href="/docs/manual/reference/configuration-options/#mongodb-setting-auditLog.schema">
   <code class="leafygreen-ui-1l06pbn">
    auditLog.schema
   </code>
  </a>
  configuration file option.
 </p>
 <p class="leafygreen-ui-1kp3ins">
  For examples and details on the messages returned in each schema, see
these pages:
 </p>
 <ul class="leafygreen-ui-rioki0">
  <li class="leafygreen-ui-d7p7b6">
   <p class="leafygreen-ui-1kp3ins">
    <a class="leafygreen-ui-tqgtui" href="/docs/manual/reference/audit-message/mongo/#std-label-event-audit-messages-mongo">
     mongo Schema Audit Messages
    </a>
   </p>
  </li>
  <li class="leafygreen-ui-d7p7b6">
   <p class="leafygreen-ui-1kp3ins">
    <a class="leafygreen-ui-tqgtui" href="/docs/manual/reference/audit-message/ocsf/#std-label-event-audit-messages-ocsf">
     OCSF Schema Audit Messages
    </a>
   </p>
  </li>
 </ul>
</section>
