5.3. Audit Log Reference

The audit log records changes made to the server instance. Unlike the error and access log, the audit log does not record access to the server instance, so searches against the database are not logged.
The audit log is formatted differently than the access and error logs and is basically like a time-stamped LDIF file. The operations recorded in the audit log are formatted as LDIF statements:
 timestamp: date  
 dn: modified_entry  
 changetype: action  
 action:attribute  
 attribute:new_value  
 -
 replace: modifiersname
 modifiersname: dn  
 -
 replace: modifytimestamp
 modifytimestamp: date 
 -
LDIF files and formats are described in more detail in the "LDAP Data Interchange Format" appendix of the Administrator's Guide.
Several different kinds of audit entries are shown in Example 5.8, “Audit Log Content”.

Example 5.8. Audit Log Content

 ... modifying an entry ...
 time: 20090108181429
 dn: uid=scarter,ou=people,dc=example,dc=com
 changetype: modify
 replace: userPassword
 userPassword: {SSHA}8EcJhJoIgBgY/E5j8JiVoj6W3BLyj9Za/rCPOw==
 -
 replace: modifiersname
 modifiersname: cn=directory manager
 -
 replace: modifytimestamp
 modifytimestamp: 20090108231429Z
 -


 ... modifications to o=NetscapeRoot from logging into the Console ...
 time: 20090108182758
 dn: cn=general,ou=1.1,ou=console,ou=cn=directory manager,ou=userpreferences, ou=example.com,o=netscaperoot
 changetype: modify
 replace: nsPreference
 nsPreference:: IwojVGh1IEphbiAwOCAxODoyNzo1OCBFU1QgMjAwOQpXaWR0aD03NzAKU2hvd1
 N0YXR1c0Jhcj10cnVlClNob3dCYW5uZXJCYXI9dHJ1ZQpZPTI3OApYPTI5OApIZWlnaHQ9NTE4Cg
 ==
 -
 replace: modifiersname
 modifiersname: cn=directory manager
 -
 replace: modifytimestamp
 modifytimestamp: 20090108232758Z
 -


 ... sending a replication update ...
 time: 20090109131811
 dn: cn=example2,cn=replica,cn="dc=example, dc=com",cn=mapping tree,cn=config
 changetype: modify
 replace: nsds5BeginReplicaRefresh
 nsds5BeginReplicaRefresh: start
 -
 replace: modifiersname
 modifiersname: cn=directory manager
 -
 replace: modifytimestamp
 modifytimestamp: 20090109181810Z
 -

The audit log does not have any other log level to set.