Show Table of Contents
7.3. Audit Log Reference
The audit log records changes made to the server instance. Unlike the error and access log, the audit log does not record access to the server instance, so searches against the database are not logged.
The audit log is formatted differently than the access and error logs and is basically like a time-stamped LDIF file. The operations recorded in the audit log are formatted as LDIF statements:
timestamp: date dn: modified_entry changetype: action action:attribute attribute:new_value - replace: modifiersname modifiersname: dn - replace: modifytimestamp modifytimestamp: date -
LDIF files and formats are described in more detail in the "LDAP Data Interchange Format" appendix of the Administrator's Guide.
Several different kinds of audit entries are shown in Example 7.8, “Audit Log Content”.
Example 7.8. Audit Log Content
... modifying an entry ... time: 20170108181429 dn: uid=scarter,ou=people,dc=example,dc=com changetype: modify replace: userPassword userPassword: {SSHA}8EcJhJoIgBgY/E5j8JiVoj6W3BLyj9Za/rCPOw== - replace: modifiersname modifiersname: cn=directory manager - replace: modifytimestamp modifytimestamp: 20170108231429Z - ... modifications to o=NetscapeRoot from logging into the Console ... time: 20170108182758 dn: cn=general,ou=1.1,ou=console,ou=cn=directory manager,ou=userpreferences,ou=example.com,o=netscaperoot changetype: modify replace: nsPreference nsPreference:: IwojVGh1IEphbiAwOCAxODoyNzo1OCBFU1QgMjAwOQpXaWR0aD03NzAKU2hvd1 N0YXR1c0Jhcj10cnVlClNob3dCYW5uZXJCYXI9dHJ1ZQpZPTI3OApYPTI5OApIZWlnaHQ9NTE4Cg == - replace: modifiersname modifiersname: cn=directory manager - replace: modifytimestamp modifytimestamp: 20170108232758Z - ... sending a replication update ... time: 20170109131811 dn: cn=example2,cn=replica,cn=dc=example\,dc=com,cn=mapping tree,cn=config changetype: modify replace: nsds5BeginReplicaRefresh nsds5BeginReplicaRefresh: start - replace: modifiersname modifiersname: cn=directory manager - replace: modifytimestamp modifytimestamp: 20170109181810Z -
The audit log does not have any other log level to set.
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.