Mongodb – see when a database was dropped

mongodb

I want to know if there is a way to see when a database was dropped.
Is there an entry in a log file or some other way to see when this occurred

Best Answer

If the drop command ran slowly, then it will be recorded in the logs (by default >100ms), otherwise the only record of it will be in the oplog (assuming you are running a replica set, even a single node replica set) and that is assuming that it did not occur so far in the past that it has "fallen out" of the oplog (which is a capped collection).

NOTE: Before running queries against your oplog, be aware that any such queries will be table scans, and that running such a query will potentially be slow, especially when run on an active replica set with a large oplog. If you have a secondary available, you may wish to use that for this type of query rather than add load to your primary.

With that said, let's show an example. We will call the database "foo", drop it and show how you would search the oplog for evidence of the drop. From the mongo shell your query would look like this:

use local;
db.oplog.rs.find({ns : "foo.$cmd",  "o" : { "dropDatabase" : 1 }})

And the result, if found, would look like this:

{
        "ts" : Timestamp(1412246712, 1),
        "h" : NumberLong("-6606042550253448275"),
        "v" : 2,
        "op" : "c",
        "ns" : "foo.$cmd",
        "o" : {
                "dropDatabase" : 1
        }
}

After that, the only other place to gather such evidence would be the filesystem, since the files are unlinked/deleted when the DB is dropped. There are plenty of answers on how to do that (and the potential problems) - I've used this one successfully in the past.

Related Question