Audit control

Edit online

The Audit control explains its use with the server and provides the results.

Description
The Audit Control enables a client to send more information about an operation. This additional information is a unique ID and an IP address. The additional information is audited in the audit log.
Note: This control is always enabled.
OID
1.3.18.0.2.10.22
Syntax
requestID	DirectoryString

controlValue:=SEQUENCE {
{SEQUENCE of requestID}
clientIP		String
}
Behavior
This control is registered for the following operations:
  • Any
  • Add
  • Bind
  • Compare
  • Delete
  • Extended Operations
  • Search
  • Modify
  • Modrdn
All users that include anonymous are enabled to send the control. However, there is an environment variable, SLAPD_AUDIT_DISABLE_NON_ADMIN, which when set, restricts the control to the following members:
  • Primary Directory Administrator
  • Local Administration Group members
  • Global Administration Group members
If SLAPD_AUDIT_DISABLE_NON_ADMIN is set to TRUE, only audit controls that are sent by administrators are audited. By default the server enables any user to send this control.
Note: If non-admin users are disabled, and the control is sent by a non-admin, the control is ignored, even if it is critical.
If there is more information that is required for the control, the error is ignored, and the information is audited.

The Administration Server recognizes the control, but audits only one of these controls per operation. The behavior for the Administration Server is the same.

Scope
The control lasts for the term of one operation. Each operation treats the control the same. If the operation is audited, the additional information that is sent in the control is audited as well.
Auditing
When the server receives this control, the audit plug-in adds the following lines to the audit entry: 
controlType: control ID
criticality: true | false
requestID: request ID sent in the control
requestID: request ID sent in the control
requestID: request ID sent in the control
clientIP: client IP sent in the control