Utilities for logging

Edit online

IBM® Verify Directory provides several logs that can be viewed either through Web Administration Tool or the system command line. Use these logs to identify the cause of a problem.

For information about viewing the logs, see the Administering section in the IBM Verify Directory documentation. For information about resolving error messages that you find in the logs, see Error Message Reference.

By default, all the logs that are listed here are in the directory_server_instance_home/logs (or directory_server_instance_home\logs on Windows™) directory. The file names that are shown are the defaults, but you can change both the paths and the file names for the logs. For more information, see the Administering section in the IBM Verify Directory documentation. The IBM Verify Directory logs are:
Administration server log (ibmdiradm.log)
An administration server is a limited LDAP server that accepts searches and extended operations to stop, start, and restart the LDAP server. You can view the status and errors that are encountered by the administration server in the administration server log.
A sample of the log is shown here:
2023-05-31T14:41:57.504844-7:00 GLPWRP123I The program '/opt/ibm/ldap/V11.0.1/sbin/64/ibmdiradm' is used with the following arguments '-I sdstst1'.
2023-05-31T14:41:57.515904-7:00 GLPADM056I Admin server starting.
2023-05-31T14:41:57.786040-7:00 GLPCOM025I The audit plugin is successfully loaded from libldapaudit.so.
2023-05-31T14:41:57.806484-7:00 GLPCOM022I The database plugin is successfully loaded from libback-config.so.
2023-05-31T14:41:57.817667-7:00 GLPADM060I The admin server backup and restore server configuration entry is not enabled.
2023-05-31T14:41:57.818770-7:00 GLPCOM024I The extended Operation plugin is successfully loaded from libloga.so.
2023-05-31T14:41:57.822744-7:00 GLPCOM008E The required attribute ibm-slapdAdminPW is missing for entry cn=Configuration.
2023-05-31T14:41:57.822840-7:00 GLPCOM008E The required attribute ibm-slapdAdminDN is missing for entry cn=Configuration.
2023-05-31T14:41:57.831046-7:00 GLPCOM003I Non-SSL port initialized to 3538.
2023-05-31T14:41:57.840479-7:00 GLPADM028I Admin server audit logging is started.
2023-05-31T14:41:57.841255-7:00 GLPADM004I 11.0.1.0    ibmdiradm started
2023-05-31T14:41:57.841719-7:00 GLPSRV048I Started 5 worker threads to handle client requests.
Administration server audit log (adminaudit.log)
Administration server audit log is used to improve the security of the administration server. The directory administrator and administrative group members can use the records in the audit log to check for suspicious patterns of activity to detect security violations. If security is violated, the audit log can be used to determine how and when the problem occurred and perhaps the amount of damage done.
Since the Administration server is integrated with the directory server’s code base, to fine grain the auditing configuration, in addition to ibm-audit, auditing is extended to include audit configuration attributes such as ibm-auditbind, ibm-auditunbind, ibm-auditExtOp, ibm-auditSearch, ibm-auditVersion, and ibm-slapdLog. For the audit configuration changes to take effect, the Administration server must receive the dynamic update configuration request or you must restart the Administration server.
Note: If any additional “MAY” attributes are specified, the server ignores the values and no error messages are written.
A sample of the log is shown here: 
2023-05-31T14:52:50.726000-7:00--GLPSRV023I Directory server audit logging started. The audit configuration options are: ibm-slapdLog = /home/sdstst1/idsslapd-sdstst1/logs/adminaudit.log,ibm-auditVersion = 3,ibm-audit = true,ibm-auditFailedOPonly = false,ibm-auditBind = true,ibm-auditUnbind = true,ibm-auditSearch = true,ibm-auditExtOp = true.
2023-05-31T14:52:50.761000-7:00--GLPSRV009I 11.0.1.0 server started.
AuditV3--2023-05-31T14:52:51.123000-7:00--V3 Bind--bindDN: CN=ROOT
  --client: 127.0.0.1:3665--connectionID: 0--received: 
       2023-05-31T14:52:51.120000-7:00--Success
AuditV3--2023-05-31T14:52:52.123000-7:00--V3 Search--bindDN: CN=ROOT
  --client: 127.0.0.1:3665--connectionID: 0--received: 
	2023-05-31T14:52:52.120000-7:00--Success
AuditV3--2023-05-31T14:52:53.125000-7:00--V3 Unbind--bindDN: CN=ROOT
  --client: 127.0.0.1:3665--connectionID: 0--received:
	 2023-05-31T14:52:53.120000-7:00--Success
AuditV3--2023-05-31T14:52:54.123000-7:00--V3 Bind--bindDN: CN=ROOT
  --client: 127.0.0.1:3678--connectionID: 1--received:
	 2023-05-31T14:52:54.120000-7:00--Invalid credentials
AuditV3--2023-05-31T14:52:55.123000-7:00--V3 Unbind--bindDN: --client:
	 127.0.0.1:3678--connectionID: 1--received:
	 2023-05-31T14:52:55.120000-7:00--Success
Server audit log (audit.log)
Audit logging is used to improve the security of the directory server. The primary directory administrator and administrative group members with AuditAdmin and ServerConfigGroupMember roles can use the activities that are stored in the Server audit log. They can check for suspicious patterns of activity in an attempt to detect security violations. If security is violated, the Server audit log can be used to determine how and when the problem occurred and perhaps the amount of damage done. This information is useful, both for recovery from the violation and, possibly, in the development of better security measures to prevent future problems.
The Server audit log records the DNs of the Administrative Group members and their assigned roles each time the server starts and anytime their roles change. The format of the record is displayed. Records to be logged after server starts is as follows: 
date-time--message ID Administrative roles assigned to user DN 
are: role role ...
For more information about administrative roles and permissions that are required to access various objects, see Administering section in the IBM Verify Directory documentation. Search for the section, Creating the administrative group.
A sample of the Server audit log is shown here:
2023-06-11T12:28:19.784000-7:00--GLPSRV023I Directory server audit logging started. 
     The audit configuration options are: ibm-slapdLog = /home/sdstst1/idsslapd-sdstst1/logs/audit.log,
     ibm-auditVersion = 3,ibm-audit = true,ibm-auditFailedOPonly = false,ibm-auditBind = true,ibm-auditUnbind = true,
     ibm-auditSearch = true,ibm-auditAdd = true,ibm-auditModify = true,ibm-auditDelete = true,ibm-auditModifyDN = true,
     ibm-auditExtOPEvent = true,ibm-auditExtOp = true,ibm-auditAttributesOnGroupEvalOp = true,ibm-auditCompare = true,
     ibm-auditGroupsOnGroupControl = true,ibm-auditPerformance = true,ibm-auditPTABindInfo = true.
2023-06-11T12:28:19.802000-7:00--GLPSRV009I 11.0.1.0 server started.
2023-06-11T12:28:19.802000-7:00--The password encryption attribute 'ibm-slapdPwEncryption' is set to : aes256
2023-06-11T12:28:19.802000-7:00--Replication conflict resolution attribute 'ibm-slapdNoReplConflictResolution' is set to false
2023-06-11T12:28:19.802000-7:00--Attribute restricting access to replication topology 'ibm-slapdReplRestrictedAccess' is set to false
AuditV3--2023-06-11T12:28:22.769000-7:00--V3 SSL TLSV13 Bind--bindDN: cn=root--client: 10.21.46.207:33694--connectionID: 1
     --received: 2023-06-11T12:28:22.769000-7:00--Success
operationResponseTime: 0
timeOnWorkQ: 0
rdbmLockWaitTime: 0
clientIOTime: 0
controlType: 1.3.6.1.4.1.42.2.27.8.5.1
criticality: false
name: cn=root
authenticationChoice: simple
Admin Acct Status: Not Locked
AuditV3--2023-06-11T12:28:22.776000-7:00--V3 SSL TLSV13 Search--bindDN: cn=root--client: 10.21.46.207:33694--connectionID: 1
     --received: 2023-06-11T12:28:22.769000-7:00--Success
operationResponseTime: 7
timeOnWorkQ: 0
rdbmLockWaitTime: 0
clientIOTime: 0
controlType: 1.3.6.1.4.1.42.2.27.8.5.1
criticality: false
base: o=sample
scope: wholeSubtree
derefAliases: neverDerefAliases
typesOnly: false
filter: (objectclass=*)
attributes: cn sn
numberOfEntriesReturned: 6
AuditV3--2023-06-11T12:28:22.778000-7:00--V3 SSL TLSV13 Unbind--bindDN: cn=root--client: 10.21.46.207:33694--connectionID: 1
     --received: 2023-06-11T12:28:22.778000-7:00--Success
operationResponseTime: 0
timeOnWorkQ: 0
rdbmLockWaitTime: 0
clientIOTime: 0
Bulkload error log (bulkload.log)
The idsbulkload (or bulkload) command is used to load entries. Use the bulkload log to view status and errors that are related to bulkload.
For example, the command bulkload -I ldapdb2 -i bad.ldif was used to load entries for instance ldapdb2 from an invalid LDIF file named bad.ldif, which contained the following lines:
dn: cn=abc,o=sample
objectclass:person
cn:caaa
sn:abc
The following bulkload error log resulted: 
2023-06-05T16:54:20.840894-4:00 GLPCTL113I Largest core file size creation limit for the process (in bytes): '-1'(Soft limit) and '-1'(Hard limit).
2023-06-05T16:54:20.840952-4:00 GLPCTL114I Largest file size creation limit for the process (in bytes): '-1'(Soft limit) and '-1'(Hard limit).
2023-06-05T16:54:20.840968-4:00 GLPCTL115I Maximum data segment limit for the process (in bytes): '-1'(Soft limit) and '-1'(Hard limit).
2023-06-05T16:54:20.840983-4:00 GLPCTL116I Maximum physical memory limit for the process (in bytes): '-1'(Soft limit) and '-1'(Hard limit).
2023-06-05T16:54:20.861242-4:00 GLPBLK072I Bulkload started.
2023-06-05T16:54:20.861273-4:00 GLPBLK050I Extracting parent DNs ...
2023-06-05T16:54:20.896885-4:00 GLPBLK061I Parsing entries ...
2023-06-05T16:54:28.265392-4:00 GLPBLK004I 50 entries parsed successfully out of 50 attempts.
2023-06-05T16:54:46.642454-4:00 GLPBLK073I Bulkload completed.
Tools log (idstools.log)
The tools log contains status and error messages that are related to the configuration tools, such as idscfgdb, idsucfgdb, idscfgchglog, idsucfgchglog, idscfgsuf, idsucfgsuf, idsdnpw, idsxcfg, idsxinst, idscfgsch, and idsucfgsch.

The following sample shows the tools log:

2023-06-05T01:57:04.933038-4:00 GLPWRP123I The program '/opt/ibm/ldap/V11.0.1/sbin/64/idscfgdb' is used with the following arguments '-I sample -a sample -t sample -w ***** -l /home/sample -n'.
2023-06-05T01:57:04.940048-4:00 GLPCDB035I Adding database 'sample' to directory server instance: 'sample'.
2023-06-05T01:57:05.729540-4:00 GLPCTL017I Cataloging database instance node: 'sample'.
2023-06-05T01:57:05.788306-4:00 GLPCTL018I Cataloged database instance node: 'sample'.
2023-06-05T01:57:05.788370-4:00 GLPCTL008I Starting database manager for database instance: 'sample'.
2023-06-05T01:57:06.140130-4:00 GLPCTL009I Started database manager for database instance: 'sample'.
2023-06-05T01:57:06.140225-4:00 GLPCTL026I Creating database: 'sample'.
2023-06-05T01:57:52.342852-4:00 GLPCTL027I Created database: 'sample'.
2023-06-05T01:57:52.342969-4:00 GLPCTL034I Updating the database: 'sample'
2023-06-05T01:57:59.423203-4:00 GLPCTL035I Updated the database: 'sample'
2023-06-05T01:57:59.423327-4:00 GLPCTL020I Updating the database manager: 'sample'.
2023-06-05T01:57:59.814619-4:00 GLPCTL021I Updated the database manager: 'sample'.
2023-06-05T01:57:59.814705-4:00 GLPCTL023I Enabling multi-page file allocation: 'sample'
2023-06-05T01:58:04.877305-4:00 GLPCTL024I Enabled multi-page file allocation: 'sample'
2023-06-05T01:58:04.877449-4:00 GLPCDB005I Configuring database 'sample' for directory server instance: 'sample'.
2023-06-05T01:58:04.903297-4:00 GLPCDB006I Configured database 'sample' for directory server instance: 'sample'.
2023-06-05T01:58:04.903394-4:00 GLPCTL037I Adding local loopback to database: 'sample'.
2023-06-05T01:58:06.922457-4:00 GLPCTL038I Added local loopback to database: 'sample'.
2023-06-05T01:58:06.925255-4:00 GLPCTL011I Stopping database manager for the database instance: 'sample'.
2023-06-05T01:58:08.346654-4:00 GLPCTL012I Stopped database manager for the database instance: 'sample'.
2023-06-05T01:58:08.346744-4:00 GLPCTL008I Starting database manager for database instance: 'sample'.
2023-06-05T01:58:10.221150-4:00 GLPCTL009I Started database manager for database instance: 'sample'.
2023-06-05T01:58:10.221245-4:00 GLPCDB003I Added database 'sample' to directory server instance: 'sample'.
2023-06-05T02:13:39.503681-4:00 GLPWRP123I The program '/opt/ibm/ldap/V11.0.1/sbin/64/idsdnpw' is used with the following arguments '-I sample -u cn=root -p ***** -n'.
2023-06-05T02:13:39.508846-4:00 GLPDPW009I Setting the directory server administrator DN.
2023-06-05T02:13:39.511941-4:00 GLPDPW010I Directory server administrator DN was set.
2023-06-05T02:13:39.511967-4:00 GLPDPW006I Setting the directory server administrator password.
2023-06-05T02:13:39.558173-4:00 GLPDPW007I Directory server administrator password was set.
2023-06-05T03:33:56.663071-4:00 GLPWRP123I The program '/opt/ibm/ldap/V11.0.1/sbin/64/idscfgsuf' is used with the following arguments '-I sample -s o=sample -n'.
2023-06-05T03:33:56.668792-4:00 GLPCSF004I Adding suffix: 'o=sample'.
2023-06-05T03:33:56.672871-4:00 GLPCSF005I Added suffix: 'o=sample'.
DB2® log (db2cli.log)
Database errors that occur as a result of LDAP operations are recorded in the DB2 log.
The following sample shows the DB2 log:
2023-06-05T01:57:05.729347-4:00native retcode = -1031; state = "58031"; message = "SQL1031N  The database directory cannot be found on the indicated file system.  SQLSTATE=58031"
2023-06-05T01:57:05.788211-4:00native retcode = -1018; state = "     "; message = "SQL1018N  The node name "idsinode" specified in the CATALOG NODE command already exists."
Lost and found log (lostandfound.log)
The lost and found log archives entries that were replaced because of replication conflict resolution. Use the log of these entries to recover the data in the replaced entries if necessary.
The information that is logged for each replaced entry includes:
  • The distinguished name (DN) of the entry that is archived as a result of conflict resolution
  • The type of operation that results in the conflict; for example, add or mods.
  • The time the entry was created
  • The time the entry was last modified
  • The TCP/IP address of the supplier whose update caused the conflict
  • The LDAP Data Interchange Format (LDIF) representation of the entry that is associated with the failed update, including all the operational attributes such as ibm-entryUUID.
The following sample shows the lost and found log: 
#Entry DN: cn=t6,o=ut1,c=us
#Operation type:Add
#Corrective action:Replace
#Entry createTimestamp: 20230606211242.000000Z
#Entry modifyTimestamp: 20230607202533.000000Z
#Supplier address: 9.53.21.187
dn: cn=t6,o=ut1,c=us
objectclass: person
objectclass: top
sn: aa
cn: aa
cn: t6
description: this should not be here
ibm-entryuuid: 0c4559de-0a76-4c91-96e4-5ae81d405466
Server log (ibmslapd.log)
The server log contains status and error messages that are related to the server. For example, it contains error messages that correspond to events of adding an already existing entry, deleting a non-existent entry, or messages related to replication conflict resolution.
The following sample shows the server log with no errors:
2023-06-05T02:21:13.667390-4:00 GLPWRP123I The program '/opt/ibm/ldap/V11.0.1/sbin/64/ibmslapd' is used with the following arguments '-I sample -n -t'.
2023-06-05T02:21:13.682236-4:00 GLPSRV041I Server starting.
2023-06-05T02:21:32.730269-4:00 GLPCOM003I Non-SSL port initialized to 2389.
2023-06-05T02:21:32.732768-4:00 GLPRDB136W The number of ODBC connections is too low for the configured number of workers: 15. The number of ODBC connections will be automatically increased from 15 to 17.
2023-06-05T02:21:33.274014-4:00 GLPRDB139I 17 connections have been established with the database.
2023-06-05T02:21:33.288092-4:00 GLPRPL137I Restricted Access to the replication topology is set to false.
2023-06-05T02:21:33.960195-4:00 GLPSRV009I 11.0.1.0 server started.
Backup status file (dbback.dat)
The Administration Server reads the entry from the server configuration file that contains backup and restore configuration details if the directory server is with RDBM backend. If the server backup entries are not present or not enabled in the configuration file of directory server instance, then the Administration Server logs a message in the ibmdiradm.log file during the directory server startup. For example, the message might state: "The admin server backup and restore server configuration entry is not enabled." If the backuprestore LDAP extended operation is initiated at this stage when the backup entries are not present or not enabled, it results in a "Protocol error" and the Administration Server will log a message such as "Unsupported extended operation request OID '1.3.18.0.2.12.81'" in the ibmdiradm.log file.
Note: If the directory server is a Proxy Server, then the backup configuration entry is not read. The LDAP extended operation for backup and restore is not registered.

If the entry is present and enabled, the Administration Server checks the backup location from the configuration for the date and time of current backup. Monitor searches can be used to fetch the latest snapshot of the data that pertains to back up or restore. The file dbback.dat is the prime source for monitor searches to fetch their data from. The dbback.dat file is created at a backup location that you specify when you configure backup, for example backup_location/BACKUP_FILES.

The dbback.dat file records information like "is backup configured", "database backup location", "date and time of the last backup", "is online backup that is configured for database and change log", and other backup related information. This information can be handy in troubleshooting issues. For example, if restore fails, one of the reasons for failure can be that no backup image is available at the configured backup locations. You can deduce the reason by doing monitor searches or analyzing dbback.dat to fetch the backup information. The timestamp for the last backup is NONE in this case.

If no backup is available at the configured locations, the timestamp for the last backup is NONE and restore requests fail.

Note: User must not edit the contents of the dbback.dat file manually.