Examples

Use the examples for various operations.

For auditing version 1

2001-07-24-15:01:01.345-06:00--V3 Bind--
bindDN:cn=test--client:9.1.2.3:12345--ConnectionID:12--
received:2001-07-24-15:01:01.330-06:00--adminAuthority:Y--success
name: cn=test
authenticationChoice: simple

2001-07-24-15:01:02.367-06:00--V3 Search--
bindDN:cn=test--client:9.1.2.3:12345--ConnectionID:12--
received:2001-07-24-15:01:02.360-06:00--adminAuthority:Y--success
base: o=sample
scope: wholeSubtree
derefAliases: neverDerefAliases
typesOnly: false
filter:  (&(cn=c*)(sn=a*))

Note: See the following examples for the format differences between authenticated and unauthenticated requests.


2001-07-24-15:22:33.541-06:00--V3 unauthenticated Search--
bindDN: <*CN=NULLDN*>--client:9.1.2.2:32412--ConnectionID:18--
received:2001-07-24-15:22:33.539-06:00--adminAuthority:Y--success

2001-07-24-15:22:34.555-06:00--V3 SSL unauthenticated Search--
bindDN: <*CN=NULLDN*>--client:9.1.2.2:32412--ConnectionID:19--
received:2001-07-24-15:22:34.550-06:00--adminAuthority:Y--success

2001-07-24-15:01:03.123-06:00--V3 Add--
bindDN:cn=test--client:9.1.2.3:12345--ConnectionID:12--
received:2001-07-24-15:01:03.100-06:00--adminAuthority:Y--entryAlreadyExists
entry: cn=Jim Brown, ou=sales,o=sample
attributes: objectclass, cn, sn, telphonenumber

2001-07-24-15:01:04.378-06:00--V3 Delete--
bindDN:cn=test--client:9.1.2.3:12345--ConnectionID:12--
received:2001-07-24-15:01:04.370-06:00--adminAuthority:Y--success
entry: cn=Jim Brown, ou=sales,o=sample

2001-07-24-15:01:05.712-06:00--V3 Modify--
bindDN:cn=test--client:9.1.2.3:12345--ConnectionID:12--
received:2001-07-24-15:01:05.708-06:00--adminAuthority:Y--noSuchObject
object: cn=Jim Brown, ou=sales,o=sample
add: mail
delete: telephonenumber

2001-07-24-15:01:06.534-06:00--V3 ModifyDN--
bindDN:cn=test--client:9.1.2.3:12345--ConnectionID:12--
received:2001-07-24-15:01:06.530-06:00--adminAuthority:Y--noSuchObject
entry: cn=Jim Brown, ou=sales,o=sample
newrdn: ou=r&d
deleteoldrdn: true

2001-07-24-15:01:07.913-06:00--V3 Unbind--
bindDN:cn=test--client:9.1.2.3:12345--ConnectionID:12--
received:2001-07-24-15:01:07.910-06:00--adminAuthority:Y--success

For auditing versions 2 and 3

Bind: (Administrator account status is displayed only if the bind is an administrator bind.)

AuditV3--2005-07-19-10:01:12.630-06:00DST--V3 Bind--bindDN: cn=root--client:
127.0.0.1:43021--connectionID: 1--received: 2005-07-19-10:01:12.389-06:
 00DST--Success
name: cn=root
authenticationChoice: simple
Admin Acct Status: Not Locked

Search:

AuditV3--2005-09-09-10:49:01.863-06:00DST--V3 Search--bindDN: cn=root--client:
127.0.0.1:40722--connectionID: 2--received: 2005-09-09-10:49:01.803-06:
 00DST--Success
controlType: 1.3.6.1.4.1.42.2.27.8.5.1
criticality: false
base: o=sample
scope: wholeSubtree
derefAliases: neverDerefAliases
typesOnly: false
filter: (&(cn=C*)(sn=A*))

Compare:

AuditV3--2005-09-09-10:51:45.959-06:00DST--V3 Compare--bindDN:
cn=root--client:9.53.21.70:17037--connectionID: 5--received:
2005-09-09-10:51:45.949-06:00DST--Success
entry: cn=U1,ou=Austin,o=sample
attribute: postalcode

Add:

AuditV3--2005-09-09-10:50:55.316-06:00DST--V3 Add--bindDN: cn=root--client:
9.53.21.70:16525--connectionID: 3--received: 2005-09-09-10:50:52.652-06:
 00DST--Success
entry: cn=U1,ou=Austin,o=sample
attributes: objectclass, cn, sn, telephonenumber, internationaliSDNNumber,
title, seealso, postalcode,facsimiletelephonenumber, ibm-entryuuid

Modify:

AuditV3--2005-09-09-10:51:07.103-06:00DST--V3 Modify--bindDN: cn=root--client:
9.53.21.70:16781--connectionID: 4--received: 2005-09-09-10:51:06.923-06:
 00DST--Success
object: cn=U1,ou=Austin,o=sample
replace: postalcode

Modify DN:

AuditV3--2005-09-09-10:52:14.590-06:00DST--V3 ModifyDN--bindDN: cn=root--client:
9.53.21.70:17293--connectionID: 6--received: 2005-09-09-10:52:14.230-06:
 00DST--Success
entry: cn=U1,ou=Austin,o=sample
newrdn: cn=U1A
deleteoldrdn: true

Delete:

AuditV3--2005-09-09-10:52:36.381-06:00DST--V3 Delete--bindDN: cn=root--client:
9.53.21.70:17549--connectionID: 7--received: 2005-09-09-10:52:35.971-06:
 00DST--Success
controlType: 1.3.6.1.4.1.42.2.27.8.5.1
criticality: false
entry: cn=U1A,ou=Austin,o=sample

Unbind:

AuditV3--2005-09-09-10:51:07.143-06:00DST--V3 Unbind--bindDN: cn=root--client:
9.53.21.70:16781--connectionID: 4--received: 2005-09-09-10:51:07.143-06:
 00DST--Success

Extended Operation:
```
AuditV3--2005-09-09-10:57:11.647-06:00DST--V3 extended operation--bindDN:
cn=root--client: 9.53.21.70:17805--connectionID: 8--received:
2005-09-09-10:57:11.557-06:00DST--Success OID: 1.3.18.0.2.12.6
```
Each extended operation can have its own specific data. See Programming Reference.See the description of each extended operation in the IBM Verify Directory Programming Reference for specific details.

Auditing of Controls

Each control that is audited contains the controlType and the criticality. If the audit version is set to version 2 or higher, the server audits more information about the controls that are sent on an operation. This information is placed just after the header and before the operation-specific data. The following example is an add operation with the password policy control.

AuditV3--2005-09-09-10:50:55.316-06:00DST--V3 Add--bindDN: cn=root--client:
9.53.21.70:16525--connectionID: 3--received: 2005-09-09-10:50:52.652-06:00DST
--Success controlType: 1.3.6.1.4.1.42.2.27.8.5.1
criticality: false
entry: cn=U1,ou=Austin,o=sample
attributes: objectclass, cn, sn, telephonenumber, internationaliSDNNumber, title,
seealso, postalcode, facsimiletelephonenumber, ibm-entryuuid

Auditing of a transaction

When the server receives an operation within a transaction, the transaction ID is audited in both the audit header and in the list of controls. The transaction ID is placed just before the results of the operation in the header. The following example shows an add operation within a transaction.

AuditV3--2005-09-09-10:57:11.607-06:00DST--V3 Add--bindDN: cn=root--client:
9.53.21.70:17805--connectionID: 8--received: 2005-09-09-10:57:11.447-06:00DST
--transactionID: 11262814319.53.21.7017805--Success
controlType: 1.3.18.0.2.10.5
criticality: true
entry: cn=U1,ou=Austin,o=sample
attributes: objectclass, cn, sn, telephonenumber, internationaliSDNNumber, title,
seealso, postalcode, facsimiletelephonenumber, ibm-entryuuid

Auditing of operation with the Proxy Authorization Control

The following example shows a control with more information that is audited only if the version is set to 2 or higher:

AuditV3--2005-09-09-14:45:08.844-06:00DST--V3 Search--bindDN: cn=root--client: 1
27.0.0.1:4371--connectionID: 10--received: 2005-09-09-14:45:04.858-06:00DST
--Success
controlType: 2.16.840.1.113730.3.4.18
criticality: true
ProxyDN: dn:cn=user1,o=sample
base: o=sample
scope: wholeSubtree
derefAliases: neverDerefAliases
typesOnly: false
filter: (cn=A*)