How can I find out who is trying to connect to my MongoDB? I have a MongoDB server that I recently configured to allow only SSL connections. Now my mongo.log is filled with this:

2017-05-30T17:39:24.528+0000 I NETWORK  [conn7881820] AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections
2017-05-30T17:39:25.053+0000 I NETWORK  [conn7881821] AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections
2017-05-30T17:39:25.592+0000 I NETWORK  [conn7881822] AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections
2017-05-30T17:39:25.593+0000 I NETWORK  [conn7881823] AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections
2017-05-30T17:39:26.369+0000 I NETWORK  [conn7881824] AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections


Unfortunately the IP address of the offending process isn't logged.

How can I find out what IP is trying to connect to my MongoDB?
The IP address will be logged by default.

For example, the following log entry you shared shows activity for the connection with an ID of conn7881820:

2017-05-30T17:39:24.528+0000 I NETWORK  [conn7881820] AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections


Prior to this log line, there will be a log line that shows the establishment of this connection. The log line should look something similar to the following: 

2017-05-30T17:39:24.528+0000 I NETWORK [initandlisten] connection accepted from SOME_IP_ADDRESS:PORT #7881820 (SOME_# connections now open)


The number following the IP address will match the connection ID (without the conn portion) of the log lines in question, (i.e. #7881820)

Note: The log line I fabricated above is using the same timestamp of the log messages you provided; in reality it should be earlier in time.