On Audit events on mongos may be related to one or more events emitted by shard or config servers. On a standalone or replicaset, events may be correlated as well, such as between authorization check and DDL events.

We should include some information in events which can be used to identify these relationships.