Parsing the mongod slow-query log (id 51803, workingMillis, durationMillis)
Parent: Database Profiler vs Query Profiler · Published reference · snapshot 2026-10-31
↓ Facts as markdownall context files
Source-anchored research for Parsing the mongod slow-query log (id 51803, workingMillis, durationMillis). Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- A syntactically valid log record can contain an incomplete command. MongoDB truncates oversized attributes while retaining JSON structure and adds truncated metadata, with size metadata where applicable. Preserve those indicators before attempting to reconstruct or replay a logged query. (low confidence) [source]
- For cursor reads, retain attr.command.getMore, attr.cursorid and attr.originatingCommand when present. SERVER-107732 contains separate aggregate and getMore events with the same cursor id and their own workingMillis and durationMillis, so one record must not be interpreted as a complete multi-batch cursor lifetime. (low confidence) [source]
How it works
- workingMillis excludes tracked lock and admission/flow-control waiting; durationMillis represents elapsed operation latency. Compare execution queue wait and lock timeAcquiringMicros with these metrics to investigate contention. (high confidence) [source]
- Treat workingMillis as optional when processing mixed-version logs: MyDBOps presents 6.0 and 7.0 examples without it, and an 8.0 example with workingMillis and durationMillis. Do not substitute zero for an absent metric. (high confidence) [source]
- Do not require a query comment to correlate all cursor batches. In the SERVER-107732 reproduction, a pipeline comment on a view disappeared from subsequent getMore records when db.runCommand omitted an explicit getMore comment. This scopes affected examples and does not assert the bug remains unfixed. (low confidence) [source]
Problems, failure modes and limitations
- For structured MongoDB logs, select the numeric top-level id 51803 to identify the Slow query event, then read operation-specific keys under attr. The event id identifies the log statement, not a unique query execution. (high confidence) [source]
- SERVER-91491 documents that mongod durationMillis excluded authorization-session refresh and command parsing before its correction, and lists fix version 8.1.0-rc0. Slow LDAP-backed authorization can therefore produce application latency much larger than the older execution duration metric. (low confidence) (verified as of 2025-03-31) [source]
- MongoDB 8.2 release notes document an 8.1 change: durationMillis in slow-query logs includes command parsing and authorization time. Cross-version latency comparisons must account for that expanded measurement boundary. (low confidence) [source]
- Treat id 51803 as an operation category, then inspect attr.command before classifying an event as an application read. SERVER-48385 records an awaitable ismaster command with maxAwaitTimeMS 10000, durationMillis 9999 and the Slow query label on 4.4.0-rc6; the issue was resolved Works as Designed. This is a historical counterexample, not evidence that every later hello is logged. (low confidence) [source]
- Inspect planSummary, docsExamined, keysExamined and nreturned alongside timing when diagnosing a logged read. The official slow-operation example shows a COLLSCAN with docsExamined 20889, keysExamined 0 and nreturned 99; the independent source-oriented guide identifies these execution statistics as diagnostic attributes. (medium confidence) [source]
Comparisons and alternatives
- Starting in MongoDB 8.0, slow-operation qualification uses time spent working rather than total operation latency. Preserve attr.workingMillis and attr.durationMillis as separate metrics. (high confidence) [source]
- Use a JSON parser to read t.$date, c, ctx, id and attr rather than fixed positions or exact whitespace. MongoDB documents padding in the serialized output; Percona and OneUptime independently demonstrate structured parsing. (medium confidence) [source]
- A concrete extraction is jq -c 'select(.id == 51803) | {timestamp:.t["$date"],ctx,ns:.attr.ns,command:.attr.command,workingMillis:.attr.workingMillis,durationMillis:.attr.durationMillis}'. This combines the documented id selector and key-based jq parsing; absent fields remain null rather than becoming fabricated zeroes. (medium confidence) [source]
- Starting in MongoDB 8.0, slow-operation classification uses working time rather than total operation latency. Lock waits and flow-control waits therefore do not by themselves determine that an operation exceeds the slow-operation threshold. (medium confidence) [source]
Facts and statements
- Do not label workingMillis as CPU time. MongoDB reports CPU separately as cpuNanos; the manual says cpuNanos is available on Linux. The CurOp implementation derives working time from elapsed execution time minus tracked blocked time. (high confidence) [source]
- Normalize units before comparing planningTimeMicros with durationMillis. Percona shows planningTimeMicros=215107053 and durationMillis=215107, indicating approximately 215 seconds dominated by planning, accompanied by replanned=true and replanReason. (low confidence) [source]
- Preserve planSummary, keysExamined, docsExamined, nreturned and planningTimeMicros together with latency; both the official example and independent reproductions expose these fields for diagnosing scan and planning costs. (high confidence) [source]
- Keep workingMillis and durationMillis as separate millisecond measurements: the former represents time spent working and the latter operation latency. workingMillis is not CPU time; cpuNanos is collected separately, and the implementation derives working time from elapsed time minus tracked blocked time. (medium confidence) [source]
Children
- No children recorded.