Show Table of Contents
Red Hat Training
A Red Hat training course is available for Red Hat Directory Server
7.3. Audit Log Reference
The audit log records changes made to the server instance. Unlike the error and access log, the audit log does not record access to the server instance, so searches against the database are not logged.
The audit log is formatted differently than the access and error logs and is like a time-stamped LDIF file. The operations recorded in the audit log are formatted as LDIF statements:
timestamp: date dn: modified_entry changetype: action action:attribute attribute:new_value - replace: modifiersname modifiersname: dn - replace: modifytimestamp modifytimestamp: date -
LDIF files and formats are described in more detail in the "LDAP Data Interchange Format" appendix of the Administration Guide.
Several different kinds of audit entries are shown in Example 7.7, “Audit Log Content”.
Example 7.7. Audit Log Content
... modifying an entry ... time: 20200108181429 dn: uid=scarter,ou=people,dc=example,dc=com changetype: modify replace: userPassword userPassword: {SSHA}8EcJhJoIgBgY/E5j8JiVoj6W3BLyj9Za/rCPOw== - replace: modifiersname modifiersname: cn=Directory Manager - replace: modifytimestamp modifytimestamp: 20200108231429Z - ... modifications to o=NetscapeRoot from logging into the Console ... time: 20200108182758 dn: cn=general,ou=1.1,ou=console,ou=cn=Directory Manager,ou=userpreferences,ou=example.com,o=netscaperoot changetype: modify replace: nsPreference nsPreference:: IwojVGh1IEphbiAwOCAxODoyNzo1OCBFU1QgMjAwOQpXaWR0aD03NzAKU2hvd1 N0YXR1c0Jhcj10cnVlClNob3dCYW5uZXJCYXI9dHJ1ZQpZPTI3OApYPTI5OApIZWlnaHQ9NTE4Cg == - replace: modifiersname modifiersname: cn=Directory Manager - replace: modifytimestamp modifytimestamp: 20200108232758Z - ... sending a replication update ... time: 20200109131811 dn: cn=example2,cn=replica,cn="dc=example,dc=com",cn=mapping tree,cn=config changetype: modify replace: nsds5BeginReplicaRefresh nsds5BeginReplicaRefresh: start - replace: modifiersname modifiersname: cn=Directory Manager - replace: modifytimestamp modifytimestamp: 20200109181810Z -
Note that you cannot change to format or set a log level for the audit log.