Currently command monitoring publishes command started event for operations like find/insert before it has a socket to send the command on. Creating the socket involves other commands like auth, which leads to the following command monitoring event sequence:

start find
start saslstart
success saslstart
start saslcontinue
success saslcontinue
success find

As a result of this, the time taken by find, for example, includes the time taken by auth as well.

The driver should instead publish start of find after it has picked a connection, handshaked and authed it and published the auth events, so that command events are not nested.