Search

Chapter 2. Core server configuration attributes

download PDF

This section contains reference information on the configuration attributes that are relevant to the core server functionality. For information on changing server configuration, see Section 2.2.1.2, “Accessing and Modifying Server Configuration”. For a list of server features that are implemented as plug-ins, see Section 4.1, “Server Plug-in Functionality Reference”. For help with implementing custom server functionality, contact Directory Server support.

The configuration information stored in the dse.ldif file is organized as an information tree under the general configuration entry cn=config.

Most of these configuration tree nodes are covered in the following sections.

The cn=plugins node is covered in Chapter 4, Plug-in Implemented Server Functionality Reference. The description of each attribute contains details such as the DN of its directory entry, its default value, the valid range of values, and an example of its use.

Note

Some of the entries and attributes described in this chapter may change in future releases of the product.

2.1. cn=config

Directory Server stores general configuration entries in the cn=config entry. This entry is an instance of the nsslapdConfig object class, which in turn inherits from the extensibleObject object class.

2.1.1. nsslapd-accesslog

This attribute specifies the path and filename of the log used to record each LDAP access. The following information is recorded by default in the log file:

  • IP address (IPv4 or IPv6) of the client machine that accessed the database.
  • Operations performed (for example, search, add, and modify).
  • Result of the access (for example, the number of entries returned or an error code).

For access logging to be enabled, this attribute must have a valid path and parameter, and the nsslapd-accesslog-logging-enabled configuration attribute must be switched to on. The table lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.

Table 2.1. dse.ldif File Attributes
AttributeValueLogging enabled or disabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

on

empty string

Disabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

on

filename

Enabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

off

empty string

Disabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

off

filename

Disabled

The nsslapd-accesslog parameters description:

ParameterDescription

Entry DN

cn=config

Valid Values

Any valid filename.

Default Value

/var/log/dirsrv/slapd-instance/access

Syntax

DirectoryString

Example

nsslapd-accesslog: /var/log/dirsrv/slapd-instance/access

2.1.2. nsslapd-accesslog-compress

Directory Server does not compress the access log by default. Set nsslapd-accesslog-compress to on to enable the access log compression when Directory Server rotates the log.

You do not need to restart the server to apply changes.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-accesslog-compress: on

2.1.3. nsslapd-accesslog-level

This attribute controls what is logged to the access log.

You do not have to restart the server for this setting to take effect.

ParameterDescription

Entry DN

cn=config

Valid Values

* 0 - No access logging

* 4 - Logging for internal access operations

* 256 - Logging for connections, operations, and results

* 512 - Logging for access to an entry and referrals

* These values can be added together to provide the exact type of logging required; for example, 516 (4 + 512) to obtain internal access operation, entry access, and referral logging.

Default Value

256

Syntax

Integer

Example

nsslapd-accesslog-level: 256

2.1.4. nsslapd-accesslog-list

This read-only attribute, which cannot be set, provides a list of access log files used in access log rotation.

ParameterDescription

Entry DN

cn=config

Valid Values

 

Default Value

None

Syntax

DirectoryString

Example

nsslapd-accesslog-list: accesslog2,accesslog3

2.1.5. nsslapd-accesslog-logbuffering

When set to off, the server writes all access log entries directly to disk. Buffering allows the server to use access logging even when under a heavy load without impacting performance. However, when debugging, it is sometimes useful to disable buffering in order to see the operations and their results right away instead of having to wait for the log entries to be flushed to the file. Disabling log buffering can severely impact performance in heavily loaded servers.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-accesslog-logbuffering: off

2.1.6. nsslapd-accesslog-logexpirationtime

This attribute specifies the maximum age that a log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit attribute.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 to the maximum 32 bit integer value (2147483647)

A value of -1 or 0 means that the log never expires.

Default Value

-1

Syntax

Integer

Example

nsslapd-accesslog-logexpirationtime: 2

2.1.7. nsslapd-accesslog-logexpirationtimeunit

This attribute specifies the units for nsslapd-accesslog-logexpirationtime attribute. If the unit is unknown by the server, then the log never expires.

ParameterDescription

Entry DN

cn=config

Valid Values

month | week | day

Default Value

month

Syntax

DirectoryString

Example

nsslapd-accesslog-logexpirationtimeunit: week

2.1.8. nsslapd-accesslog-logging-enabled

Disables and enables accesslog logging but only in conjunction with the nsslapd-accesslog attribute that specifies the path and parameter of the log used to record each database access.

For access logging to be enabled, this attribute must be switched to on, and the nsslapd-accesslog configuration attribute must have a valid path and parameter. The table lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.

Table 2.2. dse.ldif Attributes
AttributeValueLogging Enabled or Disabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

on

empty string

Disabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

on

filename

Enabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

off

empty string

Disabled

nsslapd-accesslog-logging-enabled

nsslapd-accesslog

off

filename

Disabled

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-accesslog-logging-enabled: off

2.1.9. nsslapd-accesslog-logmaxdiskspace

This attribute specifies the maximum amount of disk space in megabytes that the access logs are allowed to consume. If this value is exceeded, the oldest access log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also, remember that there are three different log files (access log, audit log, and error log) maintained by Directory Server, each of which consumes disk space. Compare these considerations to the total amount of disk space for the access log.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the disk space allowed to the access log is unlimited in size.

Default Value

500

Syntax

Integer

Example

nsslapd-accesslog-logmaxdiskspace: 500

2.1.10. nsslapd-accesslog-logminfreediskspace

This attribute sets the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest access logs are deleted until enough disk space is freed to satisfy this attribute.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647)

Default Value

-1

Syntax

Integer

Example

nsslapd-accesslog-logminfreediskspace: -1

2.1.11. nsslapd-accesslog-logrotationsync-enabled

This attribute sets whether access log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way can generate log files at a specified time during a day, such as midnight to midnight every day. This makes analysis of the log files much easier because they then map directly to the calendar.

For access log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-accesslog-logrotationsynchour and nsslapd-accesslog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate access log files every day at midnight, enable this attribute by setting its value to on, and then set the values of the nsslapd-accesslog-logrotationsynchour and nsslapd-accesslog-logrotationsyncmin attributes to 0.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-accesslog-logrotationsync-enabled: on

2.1.12. nsslapd-accesslog-logrotationsynchour

This attribute sets the hour of the day for rotating access logs. This attribute must be used in conjunction with nsslapd-accesslog-logrotationsync-enabled and nsslapd-accesslog-logrotationsyncmin attributes.

ParameterDescription

Entry DN

cn=config

Valid Range

0 through 23

Default Value

0

Syntax

Integer

Example

nsslapd-accesslog-logrotationsynchour: 23

2.1.13. nsslapd-accesslog-logrotationsyncmin

This attribute sets the minute of the day for rotating access logs. This attribute must be used in conjunction with nsslapd-accesslog-logrotationsync-enabled and nsslapd-accesslog-logrotationsynchour attributes.

ParameterDescription

Entry DN

cn=config

Valid Range

0 through 59

Default Value

0

Syntax

Integer

Example

nsslapd-accesslog-logrotationsyncmin: 30

2.1.14. nsslapd-accesslog-logrotationtime

This attribute sets the time between access log file rotations. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-accesslog-logrotationtimeunit attribute.

Directory Server rotates the log at the first write operation after the configured interval has expired, regardless of the size of the log.

Although it is not recommended for performance reasons to specify no log rotation since the log grows indefinitely, there are two ways of specifying this. Either set the nsslapd-accesslog-maxlogsperdir attribute value to 1 or set the nsslapd-accesslog-logrotationtime attribute to -1. The server checks the nsslapd-accesslog-maxlogsperdir attribute first, and, if this attribute value is larger than 1, the server then checks the nsslapd-accesslog-logrotationtime attribute. See Section 2.1.17, “nsslapd-accesslog-maxlogsperdir” for more information.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the time between access log file rotation is unlimited.

Default Value

1

Syntax

Integer

Example

nsslapd-accesslog-logrotationtime: 100

2.1.15. nsslapd-accesslog-logrotationtimeunit

This attribute sets the units for the nsslapd-accesslog-logrotationtime attribute.

ParameterDescription

Entry DN

cn=config

Valid Values

month | week | day | hour | minute

Default Value

day

Syntax

DirectoryString

Example

nsslapd-accesslog-logrotationtimeunit: week

2.1.16. nsslapd-accesslog-maxlogsize

This attribute sets the maximum access log size in megabytes. When this value is reached, the access log is rotated. That means the server starts writing log information to a new log file. If the nsslapd-accesslog-maxlogsperdir attribute is set to 1, the server ignores this attribute.

When setting a maximum log size, take into consideration the following:

  • The total number of log files that can be created due to the log file rotation.
  • The Directory Server maintains five different log files: access log, audit log, audit fail log, error log, security log. Each log file consumes disk space.

Compare these considerations to the total amount of disk space you want to set for the access log.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means the log file is unlimited in size.

Default Value

100

Syntax

Integer

Example

nsslapd-accesslog-maxlogsize: 100

2.1.17. nsslapd-accesslog-maxlogsperdir

This attribute sets the total number of access logs that can be contained in the directory where the access log is stored. Each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored in this attribute, then the oldest version of the log file is deleted. For performance reasons, do not set this value to 1 because the server does not rotate the log, and it grows indefinitely.

If the value for this attribute is higher than 1, then check the nsslapd-accesslog-logrotationtime attribute to establish whether log rotation is specified. If the nsslapd-accesslog-logrotationtime attribute has a value of -1, then there is no log rotation. See Section 2.1.14, “nsslapd-accesslog-logrotationtime” for more information.

Depending on the values set in nsslapd-accesslog-logminfreediskspace and nsslapd-accesslog-maxlogsize, the actual number of logs could be less than what you configure in nsslapd-accesslog-maxlogsperdir. For example, if nsslapd-accesslog-maxlogsperdir uses the default (10 files) and you set nsslapd-accesslog-logminfreediskspace to 500 MB and nsslapd-accesslog-maxlogsize to 100 MB, Directory Server keeps only 5 access log files.

ParameterDescription

Entry DN

cn=config

Valid Range

1 to the maximum 32 bit integer value (2147483647)

Default Value

10

Syntax

Integer

Example

nsslapd-accesslog-maxlogsperdir: 10

2.1.18. nsslapd-accesslog-mode

This attribute sets the access mode or file permission with which access log files are to be created. The valid values are any combination of 000 to 777 (these mirror the numbered or absolute UNIX file permissions). The value must be a 3-digit number, the digits varying from 0 through 7:

  • 0 - None
  • 1 - Execute only
  • 2 - Write only
  • 3 - Write and execute
  • 4 - Read only
  • 5 - Read and execute
  • 6 - Read and write
  • 7 - Read, write, and execute

In the 3-digit number, the first digit represents the owner’s permissions, the second digit represents the group’s permissions, and the third digit represents everyone’s permissions. When changing the default value, remember that 000 does not allow access to the logs and that allowing write permissions to everyone can result in the logs being overwritten or deleted by anyone.

The newly configured access mode only affects new logs that are created; the mode is set when the log rotates to a new file.

ParameterDescription

Entry DN

cn=config

Valid Range

000 through 777

Default Value

600

Syntax

Integer

Example

nsslapd-accesslog-mode: 600

2.1.19. nsslapd-allow-anonymous-access

If a user attempts to connect to Directory Server without supplying any bind DN or password, this is an anonymous bind. Anonymous binds simplify common search and read operations, like checking the directory for a phone number or email address, by not requiring users to authenticate to the directory first.

However, there are risks with anonymous binds. Adequate ACIs must be in place to restrict access to sensitive information and to disallow actions like modifies and deletes. Additionally, anonymous binds can be used for denial of service attacks or for malicious people to gain access to the server.

Anonymous binds can be disabled to increase security (off). By default, anonymous binds are allowed (on) for search and read operations. This allows access to regular directory entries, which includes user and group entries as well as configuration entries like the root DSE. A third option, rootdse, allows anonymous search and read access to search the root DSE itself, but restricts access to all other directory entries.

Optionally, resource limits can be placed on anonymous binds using the nsslapd-anonlimitsdn attribute as described in Section 2.1.23, “nsslapd-anonlimitsdn”.

Changes to this value will not take effect until the server is restarted.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off | rootdse

Default Value

on

Syntax

DirectoryString

Example

nsslapd-allow-anonymous-access: on

2.1.20. nsslapd-allowed-sasl-mechanisms

Per default, the root DSE lists all mechanisms the SASL library supports. However in some environments only certain ones are preferred. The nsslapd-allowed-sasl-mechanisms attribute allows you to enable only some defined SASL mechanisms.

The mechanism names must consist of uppercase letters, numbers, and underscores. Each mechanism can be separated by commas or spaces.

Note

The EXTERNAL mechanism is actually not used by any SASL plug-in. It is internal to the server, and is mainly used for TLS client authentication. Hence, the EXTERNAL mechanism cannot be restricted or controlled. It will always appear in the supported mechanisms list, regardless what is set in the nsslapd-allowed-sasl-mechanisms attribute.

This setting does not require a server restart to take effect.

ParameterDescription

Entry DN

cn=config

Valid Values

Any valid SASL mechanism

Default Value

None (all SASL mechanisms allowed)

Syntax

DirectoryString

Example

nsslapd-allowed-sasl-mechanisms: GSSAPI, DIGEST-MD5, OTP

2.1.21. nsslapd-allow-hashed-passwords

This parameter disables the pre-hashed password checks. By default, the Directory Server does not allow pre-hashed passwords to be set by anyone other than the Directory Manager. You can delegate this privilege to other users when you add them to the Password Administrators group. However in some scenarios, like when the replication partner already controls the pre-hashed passwords checking, this feature has to be disabled on the Directory Server.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-allow-hashed-passwords: off

2.1.22. nsslapd-allow-unauthenticated-binds

Unauthenticated binds are connections to Directory Server where a user supplies an empty password. Using the default settings, Directory Server denies access in this scenario for security reasons.

Warning

Red Hat recommends not enabling unauthenticated binds. This authentication method enables users to bind without supplying a password as any account, including the Directory Manager. After the bind, the user can access all data with the permissions of the account used to bind.

You do not have to restart the server for this setting to take effect.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-allow-unauthenticated-binds: off

2.1.23. nsslapd-anonlimitsdn

Resource limits can be set on authenticated binds. The resource limits can set a cap on how many entries can be searched in a single operation (nsslapd-sizeLimit), a time limit (nsslapd-timelimit) and time out period (nsslapd-idletimeout) for searches, and the total number of entries that can be searched (nsslapd-lookthroughlimit). These resource limits prevent denial of service attacks from tying up directory resources and improve overall performance.

Resource limits are set on a user entry. An anonymous bind, obviously, does not have a user entry associated with it. This means that resource limits usually do not apply to anonymous operations.

To set resource limits for anonymous binds, a template entry can be created, with the appropriate resource limits. The nsslapd-anonlimitsdn configuration attribute can then be added that points to this entry and applies the resource limits to anonymous binds.

ParameterDescription

Entry DN

cn=config

Valid Values

Any DN

Default Value

None

Syntax

DirectoryString

Example

nsslapd-anonlimitsdn: cn=anon template,ou=people,dc=example,dc=com

2.1.24. nsslapd-attribute-name-exceptions

This attribute allows non-standard characters in attribute names to be used for backwards compatibility with older servers, such as "_" in schema-defined attributes.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-attribute-name-exceptions: on

2.1.25. nsslapd-auditfaillog

This attribute sets the path and filename of the log used to record failed LDAP modifications.

If nsslapd-auditfaillog-logging-enabled is enabled, and nsslapd-auditfaillog is not set, the audit fail events are logged to the file specified in nsslapd-auditlog.

If you set the nsslapd-auditfaillog parameter to the same path as nsslapd-auditlog, both are logged in the same file.

ParameterDescription

Entry DN

cn=config

Valid Values

Any valid filename

Default Value

/var/log/dirsrv/slapd-instance/audit

Syntax

DirectoryString

Example

nsslapd-auditfaillog: /var/log/dirsrv/slapd-instance/audit

To enable the audit fail log, this attribute must have a valid path and the nsslapd-auditfaillog-logging-enabled attribute must be set to on

2.1.26. nsslapd-auditfaillog-compress

Directory Server does not compress audit fail log by default. Set nsslapd-auditfaillog-compress to on to enable audit fail log compression when Directory Server rotates the log.

You do not need to restart the server to apply changes.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-auditfaillog-compress: on

2.1.27. nsslapd-auditfaillog-list

Provides a list of audit fail log files.

ParameterDescription

Entry DN

cn=config

Valid Values

 

Default Value

None

Syntax

DirectoryString

Example

nsslapd-auditfaillog-list: auditfaillog2,auditfaillog3

2.1.28. nsslapd-auditfaillog-logexpirationtime

This attribute sets the maximum age of a log file before it is removed. It supplies to the number of units. Specify the units, such as day, week, month, and so forth in the nsslapd-auditfaillog-logexpirationtimeunit attribute.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 to the maximum 32 bit integer value (2147483647)

A value of -1 or 0 means that the log never expires.

Default Value

-1

Syntax

Integer

Example

nsslapd-auditfaillog-logexpirationtime: 1

2.1.29. nsslapd-auditfaillog-logexpirationtimeunit

This attribute sets the units for the nsslapd-auditfaillog-logexpirationtime attribute. If the unit is unknown by the server, the log never expires.

ParameterDescription

Entry DN

cn=config

Valid Values

month | week | day

Default Value

week

Syntax

DirectoryString

Example

nsslapd-auditfaillog-logexpirationtimeunit: day

2.1.30. nsslapd-auditfaillog-logging-enabled

Turns on and off logging of failed LDAP modifications.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-auditfaillog-logging-enabled: off

2.1.31. nsslapd-auditfaillog-logmaxdiskspace

This attribute sets the maximum amount of disk space in megabytes the audit fail logs are can consume. If the size exceed the limit, the oldest audit fail log is deleted.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the disk space allowed to the audit fail log is unlimited in size.

Default Value

100

Syntax

Integer

Example

nsslapd-auditfaillog-logmaxdiskspace: 10000

2.1.32. nsslapd-auditfaillog-logminfreediskspace

This attribute sets the minimum permissible free disk space in megabytes. When the amount of free disk space is lower than the specified value, the oldest audit fail logs are deleted until enough disk space is freed.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 (unlimited) | 1 to the maximum 32 bit integer value (2147483647)

Default Value

-1

Syntax

Integer

Example

nsslapd-auditfaillog-logminfreediskspace: -1

2.1.33. nsslapd-auditfaillog-logrotationsync-enabled

This attribute sets whether audit fail log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way can generate log files at a specified time during a day, such as midnight to midnight every day. This makes analysis of the log files much easier because they then map directly to the calendar.

For audit fail log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-auditfaillog-logrotationsynchour and nsslapd-auditfaillog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate audit fail log files every day at midnight, enable this attribute by setting its value to on, and then set the values of the nsslapd-auditfaillog-logrotationsynchour and nsslapd-auditfaillog-logrotationsyncmin attributes to 0.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-auditfaillog-logrotationsync-enabled: on

2.1.34. nsslapd-auditfaillog-logrotationsynchour

This attribute sets the hour of the day the audit fail log is rotated. This attribute must be used in conjunction with nsslapd-auditfaillog-logrotationsync-enabled and nsslapd-auditfaillog-logrotationsyncmin attributes.

ParameterDescription

Entry DN

cn=config

Valid Range

0 through 23

Default Value

None (because nsslapd-auditfaillog-logrotationsync-enabled is off)

Syntax

Integer

Example

nsslapd-auditfaillog-logrotationsynchour: 23

2.1.35. nsslapd-auditfaillog-logrotationsyncmin

This attribute sets the minute the audit fail log is rotated. This attribute must be used in conjunction with nsslapd-auditfaillog-logrotationsync-enabled and nsslapd-auditfaillog-logrotationsynchour attributes.

ParameterDescription

Entry DN

cn=config

Valid Range

0 through 59

Default Value

None (because nsslapd-auditfaillog-logrotationsync-enabled is off)

Syntax

Integer

Example

nsslapd-auditfaillog-logrotationsyncmin: 30

2.1.36. nsslapd-auditfaillog-logrotationtime

This attribute sets the time between audit fail log file rotations. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditfaillog-logrotationtimeunit attribute. If the nsslapd-auditfaillog-maxlogsperdir attribute is set to 1, the server ignores this attribute.

Directory Server rotates the log at the first write operation after the configured interval has expired, regardless of the size of the log.

Although it is not recommended for performance reasons to specify no log rotation, as the log grows indefinitely, there are two ways of specifying this. Either set the nsslapd-auditfaillog-maxlogsperdir attribute value to 1 or set the nsslapd-auditfaillog-logrotationtime attribute to -1. The server checks the nsslapd-auditfaillog-maxlogsperdir attribute first, and, if this attribute value is larger than 1, the server then checks the nsslapd-auditfaillog-logrotationtime attribute. See Section 2.1.25, “nsslapd-auditfaillog” for more information.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means the time between audit fail log file rotation is unlimited.

Default Value

1

Syntax

Integer

Example

nsslapd-auditfaillog-logrotationtime: 100

2.1.37. nsslapd-auditfaillog-logrotationtimeunit

This attribute sets the units for the nsslapd-auditfaillog-logrotationtime attribute.

ParameterDescription

Entry DN

cn=config

Valid Values

month | week | day | hour | minute

Default Value

week

Syntax

DirectoryString

Example

nsslapd-auditfaillog-logrotationtimeunit: day

2.1.38. nsslapd-auditfaillog-maxlogsize

This attribute sets the maximum audit fail log size in megabytes. When this value is reached, the audit fail log is rotated. That means the server starts writing log information to a new log file. If the nsslapd-auditfaillog-maxlogsperdir parameter is set to 1, the server ignores this attribute.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means the log file is unlimited in size.

Default Value

100

Syntax

Integer

Example

nsslapd-auditfaillog-maxlogsize: 50

2.1.39. nsslapd-auditfaillog-maxlogsperdir

This attribute sets the total number of audit fail logs that can be contained in the directory where the audit log is stored. Each time the audit fail log is rotated, a new log file is created. When the number of files contained in the audit log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. The default is 1 log. If this default is accepted, the server will not rotate the log, and it grows indefinitely.

If the value for this attribute is higher than 1, then check the nsslapd-auditfaillog-logrotationtime attribute to establish whether log rotation is specified. If the nsslapd-auditfaillog-logrotationtime attribute has a value of -1, then there is no log rotation. See Section 2.1.28, “nsslapd-auditfaillog-logexpirationtime” for more information.

ParameterDescription

Entry DN

cn=config

Valid Range

1 to the maximum 32 bit integer value (2147483647)

Default Value

1

Syntax

Integer

Example

nsslapd-auditfaillog-maxlogsperdir: 10

2.1.40. nsslapd-auditfaillog-mode

This attribute sets the access mode or file permissions with which audit fail log files are to be created. The valid values are any combination of 000 to 777 since they mirror numbered or absolute UNIX file permissions. The value must be a combination of a 3-digit number, the digits varying from 0 through 7:

  • 0 - None
  • 1 - Execute only
  • 2 - Write only
  • 3 - Write and execute
  • 4 - Read only
  • 5 - Read and execute
  • 6 - Read and write
  • 7 - Read, write, and execute

In the 3-digit number, the first digit represents the owner’s permissions, the second digit represents the group’s permissions, and the third digit represents everyone’s permissions. When changing the default value, remember that 000 does not allow access to the logs and that allowing write permissions to everyone can result in the logs being overwritten or deleted by anyone.

The newly configured access mode only affects new logs that are created; the mode is set when the log rotates to a new file.

ParameterDescription

Entry DN

cn=config

Valid Range

000 through 777

Default Value

600

Syntax

Integer

Example

nsslapd-auditfaillog-mode: 600

2.1.41. nsslapd-auditlog

This attribute sets the path and filename of the log used to record changes made to each database.

ParameterDescription

Entry DN

cn=config

Valid Values

Any valid filename

Default Value

/var/log/dirsrv/slapd-instance/audit

Syntax

DirectoryString

Example

nsslapd-auditlog: /var/log/dirsrv/slapd-instance/audit

For audit logging to be enabled, this attribute must have a valid path and parameter, and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on. The table lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.

Table 2.3. Possible Combinations for nsslapd-auditlog
Attributes in dse.ldifValueLogging enabled or disabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

on

empty string

Disabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

on

filename

Enabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

off

empty string

Disabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

off

filename

Disabled

2.1.42. nsslapd-auditlog-display-attrs

With the nsslapd-auditlog-display-attrs attribute you can set attributes that Directory Server displays in the audit log to provide useful identifying information about the entry being modified. By adding attributes to the audit log, you can check the current state of certain attributes in the entry and details of the entry update.

You can display attributes in the log by choosing one of the following options:

  • To display a certain attribute of the entry that Directory Server modifies, provide the attribute name as a value.
  • To display more than one attribute, provide the space separated list of attribute names as a value.
  • To display all attributes of the entry, use an asterisk (*) as a value.

Provide the space separated list of attributes that Directory Server must display in the audit log, or use an asterisk (*) as a value to display all attributes of an entry being modified.

For example, to add the cn attribute to the audit log output, set the nsslapd-auditlog-display-attrs attribute to cn. The audit log contains then entries similar to the following:

time: 20221027102743
dn: uid=73747737483,ou=people,dc=example,dc=com
#cn: John Smith
result: 0
changetype: modify
...
ParameterDescription

Entry DN

cn=config

Valid Values

Any valid attribute name and asterisk (*)

Default Value

None

Syntax

DirectoryString

Example

nsslapd-auditlog-display-attrs: cn ou

2.1.43. nsslapd-auditlog-compress

Directory Server does not compress the audit log by default. Set nsslapd-auditlog-compress to on to enable the audit log compression when Directory Server rotates the log.

You do not need to restart the server to apply changes.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-auditlog-compress: on

2.1.44. nsslapd-auditlog-list

Provides a list of audit log files.

ParameterDescription

Entry DN

cn=config

Valid Values

 

Default Value

None

Syntax

DirectoryString

Example

nsslapd-auditlog-list: auditlog2,auditlog3

2.1.45. nsslapd-auditlog-logexpirationtime

This attribute sets the maximum age that a log file is allowed to be before it is deleted. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logexpirationtimeunit attribute.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 to the maximum 32 bit integer value (2147483647)

A value of -1 or 0 means that the log never expires.

Default Value

-1

Syntax

Integer

Example

nsslapd-auditlog-logexpirationtime: 1

2.1.46. nsslapd-auditlog-logexpirationtimeunit

This attribute sets the units for the nsslapd-auditlog-logexpirationtime attribute. If the unit is unknown by the server, then the log never expires.

ParameterDescription

Entry DN

cn=config

Valid Values

month | week | day

Default Value

week

Syntax

DirectoryString

Example

nsslapd-auditlog-logexpirationtimeunit: day

2.1.47. nsslapd-auditlog-logging-enabled

Turns audit logging on and off.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-auditlog-logging-enabled: off

For audit logging to be enabled, this attribute must have a valid path and parameter and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on. The table lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.

Table 2.4. Possible combinations for nsslapd-auditlog and nsslapd-auditlog-logging-enabled
AttributeValueLogging enabled or disabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

on

empty string

Disabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

on

filename

Enabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

off

empty string

Disabled

nsslapd-auditlog-logging-enabled

nsslapd-auditlog

off

filename

Disabled

2.1.48. nsslapd-auditlog-logmaxdiskspace

This attribute sets the maximum amount of disk space in megabytes that the audit logs are allowed to consume. If this value is exceeded, the oldest audit log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are three different log files (access log, audit log, and error log) maintained by Directory Server, each of which consumes disk space. Compare these considerations with the total amount of disk space for the audit log.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the disk space allowed to the audit log is unlimited in size.

Default Value

-1

Syntax

Integer

Example

nsslapd-auditlog-logmaxdiskspace: 10000

2.1.49. nsslapd-auditlog-logminfreediskspace

This attribute sets the minimum permissible free disk space in megabytes. When the amount of free disk space falls below the value specified by this attribute, the oldest audit logs are deleted until enough disk space is freed to satisfy this attribute.

ParameterDescription

Entry DN

cn=config

Valid Range

-1 (unlimited) | 1 to the maximum 32 bit integer value (2147483647)

Default Value

-1

Syntax

Integer

Example

nsslapd-auditlog-logminfreediskspace: -1

2.1.50. nsslapd-auditlog-logrotationsync-enabled

This attribute sets whether audit log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way can generate log files at a specified time during a day, such as midnight to midnight every day. This makes analysis of the log files much easier because they then map directly to the calendar.

For audit log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-auditlog-logrotationsynchour and nsslapd-auditlog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate audit log files every day at midnight, enable this attribute by setting its value to on, and then set the values of the nsslapd-auditlog-logrotationsynchour and nsslapd-auditlog-logrotationsyncmin attributes to 0.

ParameterDescription

Entry DN

cn=config

Valid Values

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-auditlog-logrotationsync-enabled: on

2.1.51. nsslapd-auditlog-logrotationsynchour

This attribute sets the hour of the day for rotating audit logs. This attribute must be used in conjunction with nsslapd-auditlog-logrotationsync-enabled and nsslapd-auditlog-logrotationsyncmin attributes.

ParameterDescription

Entry DN

cn=config

Valid Range

0 through 23

Default Value

None (because nsslapd-auditlog-logrotationsync-enabled is off)

Syntax

Integer

Example

nsslapd-auditlog-logrotationsynchour: 23

2.1.52. nsslapd-auditlog-logrotationsyncmin

This attribute sets the minute of the day for rotating audit logs. This attribute must be used in conjunction with nsslapd-auditlog-logrotationsync-enabled and nsslapd-auditlog-logrotationsynchour attributes.

ParameterDescription

Entry DN

cn=config

Valid Range

0 through 59

Default Value

None (because nsslapd-auditlog-logrotationsync-enabled is off)

Syntax

Integer

Example

nsslapd-auditlog-logrotationsyncmin: 30

2.1.53. nsslapd-auditlog-logrotationtime

This attribute sets the time between audit log file rotations. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logrotationtimeunit attribute. If the nsslapd-auditlog-maxlogsperdir attribute is set to 1, the server ignores this attribute.

Directory Server rotates the log at the first write operation after the configured interval has expired, regardless of the size of the log.

Although it is not recommended for performance reasons to specify no log rotation, as the log grows indefinitely, there are two ways of specifying this. Either set the nsslapd-auditlog-maxlogsperdir attribute value to 1 or set the nsslapd-auditlog-logrotationtime attribute to -1. The server checks the nsslapd-auditlog-maxlogsperdir attribute first, and, if this attribute value is larger than 1, the server then checks the nsslapd-auditlog-logrotationtime attribute. See Section 2.1.39, “nsslapd-auditfaillog-maxlogsperdir” for more information.