The remainder of this chapter describes each of the parts of the log files.
Each line of an access log file begins with a timestamp of this format:[20/Dec/2006:11:39:51 -0700]. The time stamp, -0700 indicates the time difference in relation to GMT.
The format of the time stamp can vary according to your platform. The connection, closed, and abandon records appear individually. All other records appear in pairs, consisting of a request for service record followed by a result record. The record pairs usually, but not exclusively, appear on adjacent lines.
The connection number is represented by conn=value. Every external request is listed with an incremental connection number.
When conn=Internal the operation is an internal operation. To log internal access operations, specify an access logging level of acc-internal in the dsconf configuration attribute.
The file descriptor is represented by fd=value.
Every connection from an external LDAP client to a directory server requires a file descriptor from the operating system. The file descriptor is taken from a pool of available file descriptors.
The slot number has the same meaning as file descriptor. Slot number is a legacy section of the access log and can be ignored.
The operation number is represented by op=value.
For a connection, all operation request and result pairs are given incremental operation numbers beginning with op=0. The operation number identifies the operation being performed.
When op=-1, the LDAP request for the connection was not issued by an external LDAP client, but was initiated internally.
The method type is represented by method=value.
The method type indicates which bind method was used by the client. The method type can have one of the following values.
No authentication
Simple bind with user password
SASL bind using external authentication mechanism
The LDAP version can be LDAPv2 or LDAPv3. The LDAP version gives the LDAP version number that the LDAP client used to communicate with the LDAP server.
The error number is represented by err=number.
The error number provides the LDAP result code returned from the LDAP operation. The LDAP error number 0 means that the operation was successful. For a list of LDAP result codes refer to Result Codes in Log Files.
The tag number is represented by tag=value.
The tags are used internally for message decoding and are not intended for use outside. The following tags are used most often.
A client bind operation
The entry for which you were searching
The result from a search operation
The result from a modify operation
The result from an add operation
The result from a delete operation
The result from a modify DN operation
The result from a compare operation
A search reference when the entry you perform your search on holds a referral to the entry you require. Search references are expressed in terms of a referral.
A result from an extended operation
The number of entries is represented by nentries=value.
The number of entries indicates the number of entries that matched an LDAP search request.
The elapsed time is represented by etime=value.
Elapsed time indicates the time that it took to perform the LDAP operation. An etime value of 0 means that the operation took milliseconds to perform.
To log the time in microseconds, specify an access logging level of acc-timing in the dsconf configuration attribute.
The LDAP request type indicates the type of LDAP request made by the client. The following types of LDAP requests can be made:
Search
Modify
Delete
Add
Modify DN
Extended operation
Abandon operation
The LDAP response type indicates the LDAP response being returned by the server. The following LDAP responses can be returned:
Result
Entry
Referral or search reference
The unindexed search indicator is represented by notes=U.
In an unindexed search, the database is searched instead of the index file. Unindexed searches occur for the following reasons:
The all IDs threshold was reached in the index file used for the search
An index file does not exist
The index file is not configured in the way required by the search
An unindexed search indicator is often accompanied by a large etime value because unindexed searches are usually more time consuming than indexed searches.
An extended operation OID is represented by EXT oid="OID number". See extended-operations(5dsconf) for a list of supported extended operations.
The replication change sequence number is represented in log files by csn=value.
The presence of a change sequence number indicates that replication is enabled for this naming context.
The abandon message is represented by ABANDON.
The presence of the abandon message indicates that an operation has been aborted. If the message ID succeeds in locating the operation that has been aborted, the log message reads as follows:
conn=12 op=2 ABANDON targetop=1 msgid=2 nentries=0 etime=0
However, if the message ID does not succeed in locating the operation, or if the operation had already finished prior to the ABANDON request being sent, then the log message reads as follows:
conn=12 op=2 ABANDON targetop=NOTFOUND msgid=2
The abandon message uses the following parameters:
Gives the number of entries sent before the operation was aborted
Gives the number of seconds that elapsed before the operation was aborted
Identifies the operation to be aborted. If the value is NOTFOUND, the operation to be aborted was either an unknown operation or already complete
The message ID is represented by msgId=value.
The message ID is the LDAP operation identifier generated by the client. The message ID can have a different value to the operation number, but identifies the same operation. The message ID in an ABANDON operation specifies which client operation is being abandoned.
The operation number starts counting at 0. However, in many client implementations the message ID number starts counting at 1. This explains why the message ID is frequently equal to the operation number plus 1.
Directory Server logs each stage in the multi stage bind process and, where appropriate, the progress statement SASL bind in progress is included.
The DN used for access control decisions is logged in the BIND result line and not in the bind request line.
conn=14 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=myname,dc=example,dc=com"
For SASL binds, the DN value displayed in the BIND request line is not used by the server and is, therefore, not relevant. However, for SASL binds, the authenticated DN must be used for audit purposes. Therefore, the authenticated DN must be clearly logged. Having the authenticated DN logged in the BIND result line avoids any confusion as to which DN is which.
The options description, options=persistent, indicates that a persistent search is being performed. Persistent searches can be used as a form of monitoring and can be configured to return changes to given configurations. The access log distinguishes between persistent and regular searches.