Why can't I see the logs for my Amazon DocumentDB cluster?

3 minute read

I want to review the audit logs for my Amazon DocumentDB (with MongoDB compatibility) instance, but the logs don't appear in Amazon CloudWatch.

Resolution

You can't change the parameter values in a default parameter group. Instead, create a new parameter group and attach it to your cluster.
Set the correct granularity for the DDLs, DML reads, and DML writes based on your requirements.
When you attach a cluster parameter to activate logging on your cluster, you must reboot the cluster or the instances in the cluster.
Turn on the log exports option for the logs that you want to publish in CloudWatch.

Note: The log group isn't created until the first log record occurs.

The following common issues occur with audit logs:

You can't view your DML logs in the CloudWatch directory after you turn on the audit_log parameter and set its value to enabled. The legacy setting for DDL logs is enabled. To view the DML logs, you must include dml_read or dml_write in the audit_log parameter value.
You can't see the entire query in the CloudWatch DML audit log message. This issue occurs because values in the DML event document parameter field have a 1 KB size limit. Amazon DocumentDB reduces any values that exceed 1 KB.
You can't see a command in the CloudWatch DML audit log message. When a DML command reaches the Amazon DocumentDB instance, it goes through multiple steps for audit logging. If it fails in the parsing step (syntax analysis) because of a syntax error, then the command doesn't appear in the DML audit log. If the command fails in the execution step, then it's logged.

The following common issues occur with profiler logs:

Your queries don't reach the threshold that's defined in the parameter group. Set the profiler_threshold_ms based on your requirements. 50 milliseconds is the lowest threshold that you can set.
Amazon DocumentDB profiler doesn't support the operation that you're using. Profiling supports only specific operations. Make sure that the queries you use are supported.
The profiler logs aren't correctly activated. Simulate a long query in a sample data set to check if the profiler logs are activated and work as expected. If they're activated correctly, then you can see profiler logs in the log group as /aws/docdb//profiler.

Topics