2

I have a collection that is alimented automatically to simulate user input. I used to have 32000+ documents in it, now only 2000. My collection was dropped some time yesterday and I don't know what happened.

Luckily, there is a timestamp on every document, so I can see exactly when it happened. (The oldest document in only a day old, there are new ones every 2 minutes.) How can I see what happened ?

It was likely done by a script, so it doesn't appear in .dbshell, which is capped to 99 lines anyway. Is there a history of anything done to the base, not just manually ?

Is there a way to know what caused this ?

Extra info: I'm the only one with access to the base for now, and I have only one script that can drop my tables, I haven't touched it in ages.

Teleporting Goat
  • 417
  • 1
  • 6
  • 20
  • If anyone's curious, I found the root of the problem. It's something similar to [this](http://dba.stackexchange.com/questions/160690/mongodb-ransom-attack-and-its-solution) – Teleporting Goat Jan 19 '17 at 12:59

1 Answers1

1

Check this Answer https://stackoverflow.com/a/15204638/4996928 on StackOverflow

I ended up solving this by starting mongod like this (hammered and ugly, yeah... but works for development environment):

mongod --profile=1 --slowms=1 &

This enables profiling and sets the threshold for "slow queries" as 1ms, causing all queries to be logged as "slow queries" to the file:

/var/log/mongodb/mongodb.log

Now I get continuous log outputs using the command:

tail -f /var/log/mongodb/mongodb.log

An example log:

Mon Mar  4 15:02:55 [conn1] query dendro.quads query: { graph: "u:http://example.org/people" } ntoreturn:0 ntoskip:0 nscanned:6 keyUpdates:0 locks(micros) r:73163 nreturned:6 reslen:9884 88ms
Community
  • 1
  • 1
Med Lazhari
  • 608
  • 5
  • 9