This is not only a documentation issue. Those data modification events (insertOperation/updateOperation/removeOperation) should not be logged at all regardless of auditAuthorizationSuccess state.
Instead there should be another event “directAuthMutation” which will be logged only in case of changes made to admin.system.users or addmin.system.roles collections.
documentation is mostly correct, the only thing which can be clarified is that auditAuthorizationSuccess only affects how many “authCheck” events will be logged (only failures or all).
The audit log, logs all the write operations by default but the documentations says the opposite.
With a default configuration:
--auditPath /home/zelmar/data/audit.log --auditDestination fileThe audit log captures all the write/update/delete operations. Ex:
We’ve tested in MongoDB Enterprise, and by default, the audit log doesn’t log the write operations: