mongodb self-hosted...warn before error:

280 Unable to query for op log stats, exception: {}Command failed with error 13 (Unauthorized): 'not authorized on local to execute command { collStats: "<http://oplog.rs|oplog.rs>", $db: "local", lsid: { id: UUID("a21208b4-bb4a-4dad-8470-990f6af66e19") } }' on server

The

error 13 (Unauthorized)

on

collStats: "<http://oplog.rs|oplog.rs>"

against the

local

database means the MongoDB user Airbyte is using does not have read access on the

local

database, so the connector cannot inspect the oplog and validate/use the saved offset. This is exactly the condition that leads to

Saved offset is not valid

/ invalid resume token errors in MongoDB V2 CDC. [[Mongo v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations); [GH 70222](https://github.com/airbytehq/airbyte/issues/70222)] From the linked GitHub issue, the connector logs: > Unable to query for op log stats …

not authorized on local to execute command { collStats: "<http://oplog.rs|oplog.rs>", $db: "local" ... }

[[GH 70222 log](https://github.com/airbytehq/airbyte/issues/70222)] and the maintainer confirms this is treated as a permission problem because without read access to

local

the connector cannot pull the LSN/resume position. [[GH 70222 comment](https://github.com/airbytehq/airbyte/issues/70222)] For a self‑hosted replica set, the docs say you must use a replica‑set deployment and TLS, and that CDC relies on the replica‑set oplog with its retention limits. [[Mongo v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] They do not give a full example role for self‑hosted oplog access, but for Atlas they require

readAnyDatabase

and appropriate privileges so the connector can watch the cluster’s change stream. [[Mongo v2 quick start](https://docs.airbyte.com/integrations/sources/mongodb-v2#quick-start)] Given what’s in the sources, the concrete actions you can take are: 1. Grant the Airbyte user read access on

local

(including

<http://oplog.rs|oplog.rs>

). The knowledge sources don’t list the exact role/command for self‑hosted oplog access, only that

error 13 (Unauthorized)

on

local

means missing read permission and that this must be fixed at the MongoDB side. [[GH 70222 comment](https://github.com/airbytehq/airbyte/issues/70222)] You’ll need to adjust your MongoDB roles so this user can run

collStats

and

find

on

<http://local.oplog.rs|local.oplog.rs>

. 2. Verify with the same credentials Airbyte uses that you can run, from `mongosh`: -

use local

-

db.oplog.rs.findOne()

-

db.runCommand({ collStats: "<http://oplog.rs|oplog.rs>" })

In the GitHub issue, the user verified read access with a local test, but the connector still received

Unauthorized

, which was attributed to how permissions were inherited from

admin

and applied in practice. The maintainer recommends double‑checking built‑in/inherited roles and any restrictions. [[GH 70222 comment](https://github.com/airbytehq/airbyte/issues/70222)] 3. Once permissions are fixed, if you already hit a

Saved offset is not valid

/ invalid resume token: - You may have to reset the connection and run a fresh full sync, because when the oplog can’t be read or its entries have aged out, the previous resume token may no longer be usable. [[Mongo v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations); [GH 62833](https://github.com/airbytehq/airbyte/issues/62833)] 4. Also check oplog retention / sync frequency, since invalid resume tokens can also be caused by oplog entries expiring before the next sync: - Increase oplog size/retention. - Or increase Airbyte sync frequency. [[Mongo v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] The knowledge sources do not provide a step‑by‑step role definition for self‑hosted `local`/`oplog.rs` access; they only indicate that the

Unauthorized

on

local

must be resolved at the permission level and that, until then, the connector will keep failing with offset‑related errors.