Configuring preaudit records
Auditing can be configured to audit operations before they complete. This is known as pre-auditing. You can configure preaudit records using the instructions provided here.
About this task
When pre-audit records are enabled, the audit plug-in
is invoked to update an audit record before the operation completes.
To enable pre-auditing, you must set the value of the IBMSLAPD_PREOP_AUDIT
environment variable to "YES". This can be done by accessing the environment
variable or by using the ldapmodify command with the following format:
ldapmodify -D <adminDN> -w <adminPW>
dn: cn=Front End, cn=configuration
changetype: modify
add: ibm-slapdSetEnv
ibm-slapdSetEnv: IBMSLAPD_PREOP_AUDIT=YESNote:
- The server must be restarted for the changes to take effect.
- Pre-auditing must be used only for debugging purposes. It changes the format and breaks tools that parse the logs.
An example of a pair of diagnostic audit records
when pre-audit is enabled, where the sequence identifier is 3: <"PREOP:
3" and "POSTOP: 3">, is as follows:
AuditV3--2007-08-29-11:44:32.912-06:00DST--V3 PREOP: 3 threadId:1161116592
Search--bindDN: cn=root--client: 127.0.0.1:1044--connectionID:
3--received: 2007-08-29-11:44:32.912-06:00DST--Success
controlType: 1.3.6.1.4.1.42.2.27.8.5.1
criticality: false
base: o=sample
scope: baseObject
derefAliases: neverDerefAliases
typesOnly: false
filter: (objectclass=*)
AuditV3--2007-08-29-11:44:33.092-06:00DST--V3 POSTOP: 3 threadId:1161116592
Search--bindDN: cn=root--client: 127.0.0.1:1044--connectionID:
3--received: 2007-08-29-11:44:32.912-06:00DST--Success
controlType: 1.3.6.1.4.1.42.2.27.8.5.1
criticality: false
base: o=sample
scope: baseObject
derefAliases: neverDerefAliases
typesOnly: false
filter: (objectclass=*)