5.3 Ensure that logging captures as much information as possible

Information

The SystemLog.quiet option stops logging of information such as:

connection events

authentication events

replication sync activities

evidence of some potentially impactful commands being run (eg: drop, dropIndexes, validate)

This information should be logged whenever possible. This check is only for Enterprise editions.

Rationale:

The use of SystemLog.quiet makes troubleshooting problems and investigating possible security incidents much more difficult.

Solution

Set SystemLog.quiet to False in the /etc/mongod.conf file to disable it.

See Also

https://workbench.cisecurity.org/files/168

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c.

Plugin: Unix

Control ID: e050d641adc0cb04319f9f31624b1c1fc7aece418ce4000274cc0aa19c90d18f