Audit plug-ins

Operating system administrators might want to use the system audit facilities to log the LDAP audit record with the system-defined record format. To allow flexibility in logging and record formats, a plug-in interface is provided.

The server uses this interface to provide three types of auditing-related data to the external audit plug-ins if the auditing configuration is set to ON. The data is passed to the external audit plug-ins through the standard plug-in's pblock interfaces, slapi_pblock_set() and slapi_pblock_get().

Audit Configuration Information

This information is used to inform the external audit plug-in that at least one of the audit configuration options are changed. The server expects the plug-in to determine whether to log the audit data that is associated with a particular LDAP operation, so it is important for the plug-in to have the current audit configuration information that is maintained by the server.

Audit Event Information

This information is used to inform the audit plug-in that certain events happened. Event IDs along with a message text that describes the event are sent by the server to the audit plug-in when such events occur. For example, Auditing Started, Auditing Ended, or Audit Configuration Options Changed.

Audit Record Information

This information is the audit data that is associated with each LDAP request received by the server. For each LDAP request, if the ibm-audit configuration option is set, the server provides the header data, control structure (if available), and operation-specific data to the audit plug-in. It is up to the audit plug-in to check its own copy of the LDAP audit configuration options or its platform-specific audit policy to determine whether to log and how to log the audit data.

The header file audit-plugin.h that defines the audit plug-in interface and data structures is shipped with the IBM® Verify Directory C-Client SDK.

A default audit plug-in is provided and configured with the server. This plug-in performs the logging and formatting of the LDAP audit record. This default plug-in can be replaced with the platform-specific audit plug-in, if available, by changing the plug-in configuration lines in the ibmslapd.conf configuration file or through the IBM Verify Directory Web Administration Tool.