Query items for Audit namespace
The query items in the Audit namespace are listed here.
- LDAP Audit
- The LDAP Audit query subject has the following query items:
- Audit Version
- Represents the audit version. If the audit version is 3, then Audit Version is AuditV3.
- Audit Timestamp
- Represents the time stamp when the event was audited. It corresponds to the time stamp that is present in the header part of the audit log.
- Event Type
- Represents the operation type such as, V3 Bind, V3 Modify, and so on. It corresponds to the operation type that is present in the audit header.
- Bind DN
- Represents the bind DN. For V3 unauthenticated or anonymous requests, this field is <*CN=NULLDN*>. It corresponds to the bind DN in the audit header.
- Client IP
- Represents the client IP from the audit header.
- Client Port
- Represents the client port from the audit header.
- Connection ID
- Represents the LDAP connection ID. It corresponds to the connectionID attribute from the audit header.
- Received Timestamp
- Represents the time stamp when the request was received. It corresponds to the received attribute from the audit header.
- Operation Result
- Shows the result or status of the LDAP operation. It corresponds to the result string from the audit header.
- Unique ID
- The unique request ID to be stored in the control. The Client IP is the client's original IP to be stored in the control. If critical is true the criticality of the control will be set to true; if false the criticality will be set to false.
- Audit Control Client IP
- Represents the client IP that is sent in the Audit control. It corresponds to the ClientIP attribute from the audit log.
- Request ID
- Represents the request ID that is sent in the additional information, if the control is the Audit control and server audit is configured to audit the additional information. It corresponds to the RequestID attribute from the audit log.
- Normalized
- Represents the Normalized attribute from the additional information that is sent on the group authorization control. The value is TRUE or FALSE.
- Control Value
- Authorization Group
- Represents the group name that is sent on a Group authorization control, if the server audit is configured to audit the group. It corresponds to the Group attribute from the audit log.
- LDAP Control And Criticality
- Represents the string that represents the LDAP control and its criticality, which is sent in the request. It corresponds to a combination of control and criticality attributes from the audit log.
- Proxy DN
- Represents the proxy DN, if the control is a Proxy authorization control. It corresponds to the ProxyDN attribute from the audit log.
- Operation Response Time
- Represents time difference in milliseconds between the time when the request was received and the time when its response was sent. It corresponds to the operationResponseTime attribute from the audit log.
- Time on WorkQ
- Represents time in milliseconds, which was spent by the request in the worker queue before the execution was initiated on the operation. It corresponds to timeOnWorkQ attribute from the audit log.
- Rdbm Lock Wait Time
- Represents time in milliseconds, which was spent in acquiring locks over RDBM caches during operation execution. It corresponds to rdbmLockWaitTime attribute from the audit log.
- Client IO Time
- Represents time in milliseconds that was spent in receiving the complete operation request and returning the complete operation response. It corresponds to the clientIOTime attribute from the audit log.
- Audit Add
- The Audit Add query subject has the following query items:
- Add Entry
- Represents the DN of the entry that was added. It corresponds to the entry attribute from the LDAP Add event.
- Add Attributes
- Represents the attributes of the entry that was added. It corresponds to the attributes attribute from the LDAP Add event.
- Audit Bind
- The Audit Bind query subject has the following query items:
- User Name
- Represents the DN of the entry that did the bind. It corresponds to the name attribute from the Bind event.
- Authentication Choice
- Corresponds to the authenticationChoice attribute from the LDAP Bind event. The valid values are unknown, simple, krbv42LDAP, krbv42DSA, or sasl.
- Authentication Mechanism
- Corresponds to the authenticationMechanism attribute from the LDAP Bind event.
- Mapped Name
- Corresponds to the mappedname attribute from the LDAP Bind event.
- Authz ID
- Corresponds to the authzId attribute from the LDAP Bind event.
- Admin Account Status
- Corresponds to the Admin Acct Status attribute from the LDAP Bind event. The valid values are Not Locked, Locked, or Lock Cleared.
- Passthrough Bind DN
- Represents the bind DN used by IBM® Verify Directory to bind to a pass-through directory. It corresponds to passthroughBindDN attribute from the audit log.
- Passthrough Server
- Represents the host name IP address and port of the pass-through directory. It corresponds to passthroughServer attribute from the audit log.
- Passthrough Bind RC
- Represents the return code from the pass-through directory. It corresponds to passthroughBindRC attribute from the audit log.
- Audit Compare
- The Audit Compare query subject has the following query items:
- Compare Entry
- Represents the DN of the entry on which the compare operation was done. It corresponds to the entry attribute from the LDAP Compare event.
- Compare Attribute
- Represents the name of the attribute on which the compare operation was done. It corresponds to the attribute attribute from the LDAP Compare event.
- Audit Delete
- The Audit Delete query subject has the following query items:
- Delete Entry
- Represents the DN of the entry that was deleted. It corresponds to the entry attribute from the LDAP Delete event.
- Audit ExtendedOp
- The Audit ExtendedOp query subject has the following query item:
- OID
- Represents the OID of the extended operation that was done. It corresponds to the OID attribute from the LDAP extended event.
- Audit ModifyDN
- The Audit ModifyDN query subject has the following query items:
- ModifyDN Entry
- Represents the DN of the entry on which the ModifyDN operation was done. It corresponds to the entry attribute from the LDAP ModifyDN event.
- New RDN
- Represents the new RDN attribute of the LDAP entry on which ModifyDN operation was done. It corresponds to the newrdn attribute from the LDAP ModifyDN event.
- Delete Old RDN
- Indicates whether the old RDN attribute was deleted from the LDAP entry. It corresponds to the deleteoldrdn attribute from the LDAP ModifyDN event.
- New Superior
- Represents the DN of the new parent of the LDAP entry on which the ModifyDN operation was done. It corresponds to the newSuperior attribute from the LDAP ModifyDN event.
- Audit Modify
- The Audit Modify query subject has the following query items:
- Modify Object
- Represents the DN of the entry on which the Modify operation was done. It corresponds to the object attribute from the LDAP Modify event.
- Modify Action And Attribute
- Shows a list of the combination of modify actions and names of the attributes that were involved in the Modify operation.
- Audit RegEventNotify
- The Audit RegEventNotify query subject has the following query
items:
- Event ID
- Represents the ID the event that was registered. It corresponds to the eventID attribute from the audit log.
- RegEventNotify Base
- Represents the DN of the subtree for which the event is registered. It corresponds to the base attribute from the audit log.
- RegEventNotify Scope
- Represents the scope of the operation. It corresponds to the scope attribute from the audit log.
- Operation Type
- Represents the type of operations for which the event registration was done. It corresponds to the type attribute from the audit log.
- Audit Search
- The Audit Search query subject has the following query items:
- Search Base
- Represents the search base that is used in the LDAP Search operation. It corresponds to the base attribute from LDAP Search event.
- Search Scope
- Represents the search scope that is used in the LDAP Search operation. It corresponds to the scope attribute from the LDAP Search event.
- Deref Aliases
- Indicates whether the server must dereference the aliases. It corresponds to the derefAliases attribute from the LDAP Search event.
- Filter
- Represents the search filter that is used in the Search operation. It corresponds to the filter attribute from the LDAP Search event.
- Types Only
- Indicates whether the Search operation is requesting attributes only. It corresponds to the typesOnly attribute from the LDAP Search event.
- Search Attributes
- Represents the list of attributes that were requested in the search request. It corresponds to the attributes attribute from the LDAP Search event.
- Entries Returned
- Represents the number of entries that were returned in the Search operation. It corresponds to the numberOfEntriesReturned attribute from the LDAP Search event.
- Audit UnregEventNotify
- The Audit UnregEventNotify query subject has the following query
item:
- ID
- Represents the ID of the event that was unregistered. It corresponds to the ID attribute from the audit log.