Chapter 8. Monitoring server and database activity

Prerequisite

• Ensure the server is running to use the dconf utility.

Procedure

• To monitor the server performance using the command-line, run:

  # dsconf <instance_name> monitor server

  Copy to Clipboard Toggle word wrap

Procedure

• To run a health check, enter:

  # dsctl <instance_name> healthcheck
  Beginning lint report, this could take a while ...
  Checking Backends ...
  Checking Config ...
  Checking Encryption ...
  Checking FSChecks ...
  Checking ReferentialIntegrityPlugin ...
  Checking MonitorDiskSpace ...
  Checking Replica ...
  Checking Changelog ...
  Checking NssSsl ...
  Healthcheck complete.
  1 Issue found!  Generating report ...

  Copy to Clipboard Toggle word wrap

  To display the output in JSON format, pass the --json parameter to the command:

  # dsctl --json <instance_name> healthcheck

  Copy to Clipboard Toggle word wrap

  Example 8.1. Possible report of the health check

  [1] DS Lint Error: DSELE0001
  --------------------------------------------------------------------------------
  Severity: MEDIUM
  Affects:
   -- cn=encryption,cn=config
  
  Details:
  -----------
  This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to
  have a number of issues with the protocol. Please see:
  
  https://tools.ietf.org/html/rfc7457
  
  It is advised you set this value to the maximum possible.
  
  Resolution:
  -----------
  There are two options for setting the TLS minimum version allowed.  You,
  can set "sslVersionMin" in "cn=encryption,cn=config" to a version greater than "TLS1.0"
  You can also use 'dsconf' to set this value.  Here is an example:
  
      # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2
  
  You must restart the Directory Server for this change to take effect.
  
  Or, you can set the system wide crypto policy to FUTURE which will use a higher TLS
  minimum version, but doing this affects the entire system:
  
      # update-crypto-policies --set FUTURE
  
  
  ===== End Of Report (1 Issue found) =====

  Copy to Clipboard Toggle word wrap

  Example 8.2. Possible report of the health check in JSON format

  [
      {
          "dsle": "DSELE0001",
          "severity": "MEDIUM",
          "items": [
              "cn=encryption,cn=config"
          ],
          "detail": "This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to\nhave a number of issues with the protocol. Please see:\n\nhttps://tools.ietf.org/html/rfc7457\n\nIt is advised you set this value to the maximum possible.",
          "fix": "There are two options for setting the TLS minimum version allowed.  You,\ncan set \"sslVersionMin\" in \"cn=encryption,cn=config\" to a version greater than \"TLS1.0\"\nYou can also use 'dsconf' to set this value.  Here is an example:\n\n    # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2\n\nYou must restart the Directory Server for this change to take effect.\n\nOr, you can set the system wide crypto policy to FUTURE which will use a higher TLS\nminimum version, but doing this affects the entire system:\n\n    # update-crypto-policies --set FUTURE"
      }
  ]

  Copy to Clipboard Toggle word wrap

Prerequisites

• You enabled access logging.

• nsslapd-accesslog-compress (access log)
• nsslapd-errorlog-compress (error log)
• nsslapd-auditlog-compress (audit log)
• nsslapd-auditfaillog-compress (audit fail log)
• nsslapd-securitylog-compress (security log)

Procedure

• To enable log file compression, run:

  # dsconf <instance_name> config replace nsslapd-accesslog-compress=on nsslapd-errorlog-compress=on

  Copy to Clipboard Toggle word wrap

  The command enables compression for access and error logs.

• To disable log file compression, run:

  # dsconf <instance_name> config replace nsslapd-accesslog-compress=off

  Copy to Clipboard Toggle word wrap

  The command disables compression for the access log.

Verification

• Check that the log file directory contains compressed logs files:

  # ls /var/log/dirsrv/slapd-instance_name/

Procedure

• Set the nsslapd-plugin-binddn-tracking parameter to on:

  # dsconf <instance_name> config replace nsslapd-plugin-binddn-tracking=on

  Copy to Clipboard Toggle word wrap

Verification

• Display the modifiersname and internalModifiersname attributes of an entry that was changed by a plug-in. For example, if the memberOf attribute is enabled, display the attributes of a user after you added the user to a group:

Prerequisites

• You are logged in to the Directory Server instance in the web console.

Verification

• Display the modifiersname and internalModifiersname attributes of an entry that was changed by a plug-in. For example, if the memberOf attribute is enabled, display the attributes of a user after you added the user to a group:

Procedure

• To display the current activity of a database, enter:

  # dsconf <instance_name> monitor backend userRoot

  Copy to Clipboard Toggle word wrap

  This command displays the activity of the userRoot database.

• -S: specifies the time to begin the log file analysis.
• -E: specifies the time to stop the log files analysis.
• -bc: generates a report based on the number of DNs used to connect to the server and the total connection codes the server returns.
• -m: generates output data per second (-m) to a specified CSV output file.
• -M: generates output data with counts per minute (-M) to a specified CSV output file.

Procedure

• To generate a simple access log summary, run the following command:

  # logconv.pl /var/log/dirsrv/slapd-<instance_name>/access
  
  Access Log Analyzer 8.2
  Command: logconv.pl /var/log/dirsrv/slapd-<instance_name>/access
  Processing 1 Access Log(s)...
  
  [001] /var/log/dirsrv/slapd-<instance_name>/access size(bytes):77532
  
  Total Log Lines Analysed:  527
  Start of Logs:    14/Oct/2017:16:15:22.452909568
  End of Logs:      14/Oct/2017:16:39:50.157790196
  
  Processed Log Time:  0 Hours, 24 Minutes, 27.704877056 Seconds
  
  Restarts:                     10
  Secure Protocol Versions:
   - TLS1.2 client bound as uid=user_name,ou=people,o=example.com (11 connections)
   - TLS1.2 128-bit AES; client CN=CA Subsystem,O=example.com; issuer CN=Certificate Authority,O=example.com (11 connections)
   - TLS1.2 128-bit AES-GCM (2 connections)
   - TLS1.2 128-bit AES (3 connections)
  
  Peak Concurrent Connections:  38
  Total Operations:             4771
  Total Results:                4653
  Overall Performance:          97.5%
  
  Total Connections:            249          (0.17/sec)  (10.18/min)
   - LDAP Connections:          107          (0.07/sec)  (4.37/min)
   - LDAPI Connections:         128          (0.09/sec)  (5.23/min)
   - LDAPS Connections:         14           (0.01/sec)  (0.57/min)
   - StartTLS Extended Ops:     2            (0.00/sec)  (0.08/min)
  
  Searches:                     2963         (2.02/sec)  (121.13/min)
  Modifications:                649          (0.44/sec)  (26.53/min)
  Adds:                         785          (0.53/sec)  (32.09/min)
  Deletes:                      10           (0.01/sec)  (0.41/min)
  Mod RDNs:                     6            (0.00/sec)  (0.25/min)
  Compares:                     0            (0.00/sec)  (0.00/min)
  Binds:                        324          (0.22/sec)  (13.25/min)
  
  Proxied Auth Operations:      0
  Persistent Searches:          17
  Internal Operations:          0
  Entry Operations:             0
  Extended Operations:          4
  Abandoned Requests:           0
  Smart Referrals Received:     0
  
  VLV Operations:               30
  VLV Unindexed Searches:       0
  VLV Unindexed Components:     20
  SORT Operations:              22
  
  Entire Search Base Queries:   12
  Paged Searches:               2
  Unindexed Searches:           0
  Unindexed Components:         149
  
  FDs Taken:                    249
  FDs Returned:                 212
  Highest FD Taken:             107
  
  Broken Pipes:                 0
  Connections Reset By Peer:    0
  Resource Unavailable:         0
  Max BER Size Exceeded:        0
  
  Binds:                        324
  Unbinds:                      155
  ---------------------------------
   - LDAP v2 Binds:             41
   - LDAP v3 Binds:             180
   - AUTOBINDs(LDAPI):          103
   - SSL Client Binds:          0
   - Failed SSL Client Binds:   0
   - SASL Binds:                134
     - EXTERNAL: 114
     - GSSAPI: 20
   - Directory Manager Binds:   10
   - Anonymous Binds:           1
  
  Cleaning up temp files...
  Done.

  Copy to Clipboard Toggle word wrap

  The logconv.pl script prints a list of total operations, total number of connections, counts per each operation type, counts for some extended operations like persistent searches, and bind information.

  • Optional: If you must enable additional connection summaries passed as a single option, such as the number of DNs used to connect to the server (b) and the total connection codes the server (c) returns, specify the -bc option as follows:

    # lotgconv.pl -bc /var/log/dirsrv/slapd-<instance_name>/access
    
    ----- Total Connection Codes -----
    U1              3    Cleanly Closed Connections
    B1              1    Bad Ber Tag Encountered
    
    ----- Top 20 Bind DN's -----
    Number of Unique Bind DN's: 212
    1801            cn=Directory Manager
    1297            Anonymous Binds
    311              uid=jsmith,ou=people...
    87               uid=bjensen,ou=peopl...
    85               uid=mreynolds,ou=peo...
    69               uid=jrockford,ou=peo...
    55               uid=sspencer,ou=peop...

    Copy to Clipboard Toggle word wrap

  • Optional: If you must enable data output for a certain start (-S) and end time (-E) or within a specific range, run the following command

    # logconv.pl -S "[01/Jul/2022:16:11:47.000000000 -0400]" -E "[01/Jul/2022:17:23:08.999999999 -0400]" /var/log/dirsrv/slapd-<instance_name>/access
    ...
    ----------- Access Log Output ------------
    
    Start of Logs:    01/Jul/2022:16:11:47
    End of Logs:      01/Jul/2022:17:23:08

    Copy to Clipboard Toggle word wrap

    When start and end times are set, the logconv.pl command first prints the time range given, then the summary for that period.

  • Optional: If you must enable data output with counts per minute (-M) or per second (-m), run the following command:

    # logconv.pl -m|-M outputFile accessLogFile

    Copy to Clipboard Toggle word wrap