Chapter 8. Monitoring server and database activity

Prerequisites

• You enabled logging as described in Enabling or disabling logging using the command line.

Procedure

• To display the log files, use the following commands:

  # less /var/log/dirsrv/slapd-<instance_name>/access
  # less /var/log/dirsrv/slapd-<instance_name>/errors
  # less /var/log/dirsrv/slapd-<instance_name>/audit
  # less /var/log/dirsrv/slapd-<instance_name>/access
  # less /var/log/dirsrv/slapd-<instance_name>/security

  Note that by default the audit log and the audit fail log write operations to the same file.

• To display the locations of log files, use the command:

  # dsconf <instance_name> config get nsslapd-accesslog nsslapd-errorlog nsslapd-auditlog nsslapd-auditfaillog nsslapd-securitylog
  
  nsslapd-accesslog: /var/log/dirsrv/slapd-<instance_name>/access
  nsslapd-errorlog: /var/log/dirsrv/slapd-<instance_name>/errors
  nsslapd-auditlog: /var/log/dirsrv/slapd-<instance_name>/audit
  nsslapd-auditfaillog: /var/log/dirsrv/slapd-<instance_name>/auditfail
  nsslapd-securitylog: /var/log/dirsrv/slapd-<instance_name>/security

  Note

  If you have not enabled logging for a specified log type, Directory Server does not create the corresponding log file.

Prerequisites

• You are logged in to the web console.

Procedure

• To enable, for example, audit logging, do the following steps:

  1. Ensure that the logging you want to enable has the correctly configured path and filename:

     # dsconf <instance_name> logging audit get

     Audit Log Configuration
     -------------------------------------------------------
     ...
     Log name and location = /var/log/dirsrv/slapd-instance_name/audit
     ...

     The command displays the audit logging configuration. The nsslapd-auditlog attribute in the cn=config entry is responsible for storing the path and filename value.

  2. Enable the audit logging:

     # dsconf <instance_name> logging audit set logging-enabled

     The command sets the nsslapd-audit-logging-enabled attribute to on in the cn=config entry.

• To disable, for example, the error logging:

  # dsconf <instance_name> logging error set logging-disabled

  The command sets the nsslapd-errorlog-logging-enabled attribute to off in the cn=config entry.

  When you disable logging, Directory Server stops to record new events to a log file. However, the log file remains in the /var/log/dirsrv/slapd-<instance_name>/ directory.

Verification

• Check the audit logging settings:

  # dsconf <instance_name> logging audit get

  Audit Log Configuration
  -------------------------------------------------------
  ...
  Log name and location = /var/log/dirsrv/slapd-instance_name/audit
  Logging enabled = on
  ...

• Check the error logging settings:

  # dsconf <instance_name> logging error get

  Error Log Configuration
  -------------------------------------------------------
  ...
  Log name and location = /var/log/dirsrv/slapd-instance_name/errors
  Logging enabled = off
  ...

Prerequisites

• You are logged in to the web console.

Verification

• Navigate to Monitoring Logging and see if Directory Server now logs the events.

Verification

• Display the error logging settings:

  # dsconf <instance_name> logging error get

  Error Log Configuration
  ----------------------------------------------
  ...
  Max log size = 90
  Max logs = 3
  Rotation interval = 5
  Rotation interval unit = day
  TOD rotation enabled = on
  TOD rotation hour = 22
  TOD rotation minute = 55
  ...

Prerequisites

• You are logged in to the web console.

• The total size of all access log files exceeds 500 MB.
• An access log file is older that 3 weeks.

Verification

• Display the access logging settings:

  # dsconf <instance_name> logging access get

  Access Log Configuration
  --------------------------------------
  ...
  Deletion interval = 3
  Deletion interval unit = week
  ...
  Max log size = 500
  ...

Prerequisites

• You are logged in to the web console.

Prerequisites

• You enabled access and error logging.

Procedure

• To modify log levels for the access logs:

  1. Optional: List available access log levels:

     # dsconf <instance_name> logging access list-levels

     Level         Description
     ------------------------------------------
     entry         Log entry and referral stats
     default       Standard access logging
     internal      Log internal operations

  2. Set the required logging level. For example, you want the access log to contain internal access operations and the default logging:

     # dsconf <instance_name> logging access set level default internal

     The command modifies the nsslapd-accesslog-level attribute in the cn=config configuration entry.

• To modify log levels for the error logs:

  1. Optional: List available error log levels:

     # dsconf <instance_name> logging error list-levels

     Level         Description
     ----------------------------------------------
     acl           Provides very detailed access control list processing information
     aclsumary     Summarizes information about access to the server, much less verbose than level 'acl'
     backend       Backend debug logging
     ber           Logs the number of packets sent and received by the server
     cache         Database entry cache logging
     config        Prints any .conf configuration files used with the server, line by line, when the server is started
     connection    Logs the current connection status, including the connection methods used for a SASL bind
     default       Default logging level
     filter        Logs all of the functions called by a search operation
     heavytrace    Logs when the server enters and exits a function, with additional debugging messages
     house         Logging for housekeeping thread
     packet        Network packet logging
     parse         Logs schema parsing debugging information
     plugin        Plugin logging
     pwpolicy      Debug information about password policy behavior
     replication   Debug replication logging
     shell         Special authentication/connection tracking
     trace         Logs a message when the server enters and exits a function

  2. Set the required logging level. For example, you want the error log to contain search filter logging, the default logging, and config file processing:

     # dsconf <instance_name> logging error set level default filter config

     The command modifies the nsslapd-errorlog-level attribute in the cn=config configuration entry.

Prerequisites

• You are logged in to the web console.
• You enabled access and error logging.

Procedure

• To enable access and audit logging for all plug-ins, use the following command:

  # dsconf <instance_name> config replace nsslapd-plugin-logging=on

Prerequisites

• The nsslapd-accesslog attribute contains valid path and the filename for the access log file.
• The nsslapd-auditlog attribute contains valid path and the filename for the audit log file.

Procedure

• To enable access and audit logging for a specific plug-in, modify nsslapd-logAccess and nsslapd-logAudit attributes using the LDAP interface:

  # ldapmodify -D "cn=Directory Manager" -W -x -H ldap://server.example.com
  
  dn: cn=MemberOf Plugin,cn=plugins,cn=config
  changetype: modify
  replace: nsslapd-logAccess
  nsslapd-logAccess: on
  
  dn: cn=MemberOf Plugin,cn=plugins,cn=config
  changetype: modify
  replace: nsslapd-logAudit
  nsslapd-logAudit: on

Procedure

• To disable the access log buffering, enter:

  # dsconf <instance_name> logging access set buffering-disabled

  The command sets the nsslapd-accesslog-logbuffering attribute to off.

• To disable the audit log buffering, enter:

  # dsconf <instance_name> logging audit set buffering-disabled

  The command sets the nsslapd-auditlog-logbuffering attribute to off.

  Note

  Both the audit and audit fail logs use the nsslapd-auditlog-logbuffering attribute for the buffering configuration. Therefore, when you disable buffering for the audit logging, Directory Server also disables the audit fail logs buffering.

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.

Procedure

• To view a replication topology report, enter:

  # dsconf <instance_name> replication monitor

  The dsconf utility will request authentication credentials for each instance in the topology:

  Enter password for cn=Directory Manager on ldap://supplier.example.com: password
  Enter a bind DN for consumer.example.com:389: cn=Directory Manager
  Enter a password for cn=Directory Manager on consumer.example.com:389: password
  
  Supplier: server.example.com:389
  --------------------------------
  Replica Root: dc=example,dc=com
  Replica ID: 1
  Replica Status: Online
  Max CSN: 5e3acb77001d00010000
  
  Status For Agreement: "example-agreement" (consumer.example.com:1389)
  Replica Enabled: on
  Update In Progress: FALSE
  Last Update Start: 20211209122116Z
  Last Update End: 20211209122116Z
  Number Of Changes Sent: 1:21/0
  Number Of Changes Skipped: None
  Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
  Last Init Start: 20211209122111Z
  Last Init End: 20211209122114Z
  Last Init Status: Error (0) Total update succeeded
  Reap Active: 0
  Replication Status: In Synchronization
  Replication Lag Time: 00:00:00
  
  Supplier: consumer.example.com:1389
  -----------------------------------
  Replica Root: dc=example,dc=com
  Replica ID: 65535
  Replica Status: Online
  Max CSN: 00000000000000000000

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.

Verification

• Run the dsconf replication monitor command to see If dsconf utility uses credentials configured in the ~/.dsrc file. For more information, see Displaying a replication topology report using the command.

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.

Procedure

• If you want to see aliases in the report, use one of the following methods:

  • Define the aliases in the ~/.dsrc file:

    [repl-monitor-aliases]
    M1 = server1.example.com:389
    M2 = server2.example.com:389

  • Define the aliases by passing the -a alias=host_name:port parameter to the dsconf replication monitor command:

    # dsconf <instance_name> replication monitor -a M1=server1.example.com:389 M2=server2.example.com:389

    In both cases, the dsconf replication monitor command displays the alias in the output:

    ...
    Supplier: M1 (server1.example.com:389)
    --------------------------------
    Replica Root: dc=example,dc=com
    
    ...
    Supplier: M2 (server2.example.com:389)
    --------------------------------
    Replica Root: dc=example,dc=com

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.
• You are logged in to the web console.

Prerequisites

• The host is a member of replication topology.
• You initialized the consumer.
• You are logged in to the web console.

Verification

• Generate the replication topology report to see If the report asks for the credentials. For more information, see Displaying a replication topology report using the web console.

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.
• You are logged in to the web console.

Verification

• Generate the replication topology report to see If the report uses new aliases. For more information, see Displaying a replication topology report using the web console.