10 Logging, Auditing, and Monitoring the Directory

10.1.2.1 Log Messages for Specified LDAP Operations

Log messages for a specified operation are stored as a trace object. This object tracks the operation from start to finish across the various Oracle Internet Directory modules. It is entered in the log file when one of the following occur:

• An LDAP operation completes

• A high priority message is logged

• The trace messages buffer is full

Each thread has one contiguous block of information for each operation, and that block is clearly delimited. This makes it easy, in a shared server environment, to follow the messages of different threads, operations, and connections.

If, because of an internal message buffer overflow, a single trace object cannot contain all the information about an operation, then the information is distributed among multiple trace objects. Each distributed piece of information is clearly delimited and has a common header. To track the progress of the operation, you follow the trace objects and their common header to the end, which is marked with the trace message "Operation Complete".

10.1.2.2 Log Messages Not Associated with Specified LDAP Operations

Messages not associated with any LDAP operation are represented in a simple format, which is not object-based. It is entered in the log file when either the operation completes or a high priority message is encountered.

10.1.2.3 Example: Trace Messages in Oracle Internet Directory Server Log File

2003/01/28:13:44:27 * Main:1 * Starting up the OiD Server, on node dthakuri-sun 

2003/01/28:13:44:27 * Main:1 * Oid Server Connected to DB store via inst1 connect string.
2003/01/28:13:44:27 * Main:1 * OiD LDAP server started.

2003/01/28:13:44:31 * ServerController:1 * INFO * slsfctSpawnDispatcher * Entry
2003/01/28:13:44:31 * ServerController:1 * INFO * gslsfctSpawnDispatcher * Spawned server dispatcher thread successfully. Thread id : 1 
2003/01/28:13:44:31 * ServerController:1 * INFO * gslsfctSpawnDispatcher * Exit


2003/01/28:13:44:31 * ServerWorker:6 * INFO : ServerWorker : Entry 
2003/01/28:13:44:31 * ServerWorker:6 * INFO : gslsfccRegisterThread : Entry
2003/01/28:13:44:31 * ServerWorker:6 * INFO : gslsfccRegisterThread : Exit
2003/01/28:13:44:31 * ServerWorker:6 * INFO * gslfsfAStr2Filter * Filter="(|(objectclass=referral))"
2003/01/28:13:44:31 * ServerWorker:6 * INFO * gslfsfAStr2Filter * Filter="(objectclass=referral)"
2003/01/28:13:44:31 * ServerWorker:6 * INFO * gslfsfCStr2Simple * Filter="objectclass=referral"
2003/01/28:13:44:31 * ServerWorker:6 * INFO * gslsbnrNormalizeString() String to Normalize: "objectclass" 
2003/01/28:13:44:31 * ServerWorker:6 * INFO * gslsbnrNormalizeString() Normalized value: "objectclass"


BEGIN
2003/01/28:13:45:49 * ServerWorker:6 * ConnID:0 * OpId:0 * OpName:bind
13:45:49 * INFO * gslfbiADoBind * Entry
13:45:49 * INFO * gslfbiGetControlInfo * Entry
13:45:49 * INFO * gslfbiGetControlInfo * Exit
13:45:49 * INFO * gslfbiADoBind * connID=0 opID=0 Version=3 BIND dn="" method=128
13:45:49 * INFO * gslfrsBSendLdapResult * Entry
13:45:49 * INFO * gslfrsASendLdapResult2 * Entry 
13:45:49 * INFO * sgslunwWrite * Entry
13:45:49 * INFO * sgslunwWrite * Exit
13:45:49 * INFO * gslfrsASendLdapResult2 * Exit
13:45:49 * INFO * gslfrsBSendLdapResult * Exit
13:45:49 * INFO * gslfbiADoBind * Exit
13:45:49 * INFO * Total Bind operation time for dn=2588  micro sec and Total Worker time=3434  micro sec
END

2003/01/28:13:45:49 * ServerWorker:6 * INFO * ServerWorker * Operation Complete

2003/01/28:13:44:31 * ServerWorker:7 * INFO * ServerWorker : Entry 
2003/01/28:13:44:31 * ServerWorker:7 * INFO * gslsfccRegisterThread : Entry
2003/01/28:13:44:31 * ServerWorker:7 * INFO * gslsfccRegisterThread : Exit


BEGIN
2003/01/28:13:48:53 * ServerWorker:13 * ConnID:0 * OpId:0 * OpName:bind
13:48:14 * INFO * gslfbiADoBind * Entry
13:48:53 * INFO * gslfbiGetControlInfo * Entry
13:48:53 * INFO * gslfbiGetControlInfo * Exit
13:48:53 * INFO * gslfbiADoBind * conn=0 op=0 Version=3 BIND dn="cn=proxy" method=128
13:48:53 * INFO * gslsbbBind * Entry
13:48:53 * INFO * gslsbnrNormalizeString * String to Normalize: "proxy"
13:48:53 * INFO * gslsbnrNormalizeString * Normalized value: "proxy"
13:48:53 * INFO * gslfrsBSendLdapResult * Entry
13:48:53 * INFO * gslfrsASendLdapResult2 * Entry 
13:48:53 * INFO * sgslunwWrite * Entry
13:48:53 * INFO * sgslunwWrite * Exit
13:48:53 * INFO * gslfrsASendLdapResult2 * Exit
13:48:53 * INFO * gslfrsBSendLdapResult * Exit
13:48:53 * INFO * gslsbbBind * Exit
13:48:53 * INFO * gslfbiADoBind:Exit
13:48:53 * INFO * Total Bind operation time for dn = cn=proxy is  3710  micro sec
 Total Worker time = 4767  micro sec
END

2003/01/28:13:48:53 * ServerWorker:13 * INFO * ServerWorker * Operation Complete


2003/01/28:14:05:56 * ServerWorker:6 * FATAL * ServerWorker * Processing shutdown notification
2003/01/28:14:05:56 * ServerWorker:6 * WARNING * ServerWorker * Shutting down worker ID :  6

10.1.2.4 How to Interpret Trace Messages in the Log File

As shown in the sample messages in the previous section, log information can be associated with either a thread that performs an operation or one that does not. In the case of a thread that performs an operation, the header of the log contains:

• Date and time

• Thread name and identifier for the particular connection

• Connection identifier

• The name and identifier of the associated operation

A thread that does not perform an operation logs normal trace messages. Its header contains the date, time, and the thread identifier. It does not contain connection and operation-related information.

A trace object starts with the keyword BEGIN and ends with the keyword END.

Table 10-1 describes each field in a trace message.

10.1.3.1 Setting Debug Logging Levels by Using Oracle Directory Manager

To set the debug logging level:

1. In the Navigator pane, expand Oracle Internet Directory Servers and select a server instance. The group of tab pages for that server appear in the right pane.

2. Select the Debug Flags tab.

3. Select Debug Flags.

4. To generate a log for a specific problem, specify the debug logging level on this tab page. Otherwise, you can leave the check boxes on this tab page deselected.

10.1.3.2 Setting Debug Logging Levels by Using the OID Control Utility

To set debug logging levels by using the OID Control Utility, restart the Oracle directory server using the -debug flag for an LDAP server, and the -d flag for the replication server. Use the debug level number based on Table 10-2.

Because debug levels are additive, you need to add the numbers representing the functions that you want to activate, and use the sum of those in the command-line option.

By default, debug logging is turned off. To turn it on, modify the directory-specific entry (DSE) attribute orcldebugflag to the level you want. You can configure debug levels to one of the following levels.

To see debug log files generated by the OID Control Utility, navigate to $ORACLE_HOME/ldap/log.

Table 10-2 provides the complete list of debug logging levels.

For example, to trace search filter processing (512) and active connection management (256), enter 768 as the debug level (512 + 256 = 768) as follows:

oidctl server=oidldapd instance=1 flags='-debug 768' restart
oidctl server=oidrepld instance=1 flags='-h my_host -p 389 -d 768' restart

This example restarts both the Oracle directory server as well as the Oracle directory replication server with the debugging flags.

10.1.4.1 Setting the Operation Debug Dimension by Using Oracle Directory Manager

To set the operation debug dimension:

1. In the navigator pane, expand Oracle Internet Directory Servers and select a server instance. The group of tab pages for that server appear in the right pane.

2. Select the Debug Flags tab.

3. Select Debug Operation Flag.

By default, all operations are selected. To generate a log for a specific operation, select the corresponding operation. You can select more than one operation.

10.1.4.2 Setting the Operation Debug Dimension by Using ldapmodify

To log more than one operation, add the values of their dimensions. For example, if you want to trace ldapbind (1), ldapadd (4) and ldapmodify (16) operations, then create an LDIF file setting the orcldebugop attribute to 21 (1 + 4 + 16 = 21). The LDIF file is as follows:

dn:
changetype:modify
replace:orcldebugop
orcldebugop:21

To load this file, enter:

ldapmodify -h host_name -p port_number -f file_name

10.2.4.1 Setting the Audit Level by Using Oracle Directory Manager

To set the audit level by using Oracle Directory Manager:

1. In the navigator pane, expand Oracle Internet Directory Servers and select the directory server instance.

2. In the right pane, select the Audit Mask Levels tab page. This tab page lists the auditable events described in Table 10-6.

3. Select the audit level you want to use.

   Both successful and unsuccessful events are entered into the audit log if they are selected, except:

   • Bind, which logs only unsuccessful bind attempts

   • Access Violation, which logs only events in which access is denied by an ACP

4. Choose Apply.

5. Restart the directory server instance for the changes to take effect.

10.2.4.2 Setting the Audit Level by Using ldapmodify

To audit more than one event, add the values of their audit masks. For example, suppose you want to audit the events in Table 10-7.

The total value of the audit levels is 548. The ldapmodify command would therefore look something like this:

ldapmodify -p port -h host << EOF
dn:
changetype:modify
replace: orclauditlevel
orclauditlevel: 548
EOF

Restart the directory server instance after any changes are made to orclauditlevel for the changes to take effect.

10.2.5.1 Searching for Audit Log Entries by Using Oracle Directory Manager

To use Oracle Directory Manager to view audit log entries:

1. In the navigator pane, expand Oracle Internet Directory Servers and directory server instance.

2. Select Audit Log Management. The corresponding right pane appears.

3. In the Max Results (entries) field, type the maximum number of entries you want your search to retrieve. The default is 200. The directory server retrieves the number you specify, up to 1000.

4. In the Max Search Time (seconds) box, type the maximum number of seconds for the duration of your search. The value you enter here must be at least that of the default, namely, 25. The directory server searches for the amount of time you specify, up to one hour.

5. In the Search Criteria box, use the lists and text fields on the search criteria bar to focus your search.

   1. From the list at the left end of the search criteria bar, select an attribute of the entry you want to search for. Because not all attributes are used in every entry, be sure that the attribute you specify actually corresponds to one in the entry that you are searching for. Otherwise, the search fails.

   2. From the list in the middle of the search criteria bar, select a filter. These are described in Table A-39.

   3. In the text box at the right end of the search criteria bar, type the value for the attribute you just selected. For example, if the attribute you selected was cn, you could type the particular common name you want to find.

6. To further refine your search, use the buttons in the Search Criteria box to enhance the search criteria bar. These are described in Table A-40.

7. Choose Search. The results of your search appear in the Distinguished Name box.

8. To view the properties of a particular audit log entry, select it in the Distinguished Name box, then choose to exploit the features of Oracle Internet Directory Server Manageability. The Audit Log Entry dialog box displays the properties for the audit log entry you selected.

   
   

   See Also: "Configuring the Display and Duration of Searches in Oracle Directory Manager" for instructions on setting the number of entries to display in searches, and to set the time limit for searches

   
   

10.2.5.2 Searching for Audit Log Entries by Using ldapsearch

The DN for the audit log container is cn=auditlog. To search for audit log entries, perform a subtree or one-level search, with the container object cn=auditlog as the base of the search.

10.3.6.1 Enabling Information Collection by Using Oracle Enterprise Manager 10g Application Server Control Console

To enable information collection by using Oracle Enterprise Manager 10g Application Server Control Console:

1. In the Oracle Internet Directory main window, select LDAP Metrics. This displays the LDAP Diagnostic Collection Configuration page.

2. Check Collect Metrics.

3. Select Interval.

4. Enter the required password.

5. Choose Apply.

   
   

   Note: To enable critical events, use ldapmodify to set the attribute orclEventLevel to the appropriate value.

   
   

10.3.6.2 Starting a New Directory Server Instance by Using Oracle Enterprise Manager 10g Application Server Control Console

To start a server:

1. In the Oracle Internet Directory main window, choose Start New Instance. The Start a New LDAP Server Instance Window displays the fields in Table 10-10.

2. In the Set Number column, select the configuration set you want to use.

   If the default port is not available, then, in the Port Number column, specify a port number.

3. Choose Start.

10.3.6.3 Stopping a Directory Server Instance by Using Oracle Enterprise Manager 10g Application Server Control Console

To stop a directory server instance:

1. In the Oracle Internet Directory main window, in the LDAP Instances section, select the directory server instance you want to stop.

2. Choose Stop.

10.3.6.4 Restarting a Directory Server Instance by Using Oracle Enterprise Manager 10g Application Server Control Console

To restart a directory server instance:

1. In the Oracle Internet Directory main window, in the LDAP Instances section, select the server you want to restart.

2. Choose Restart. The Restart an LDAP Server Instance window displays the fields listed in Table 10-11.

3. Select a configuration. If the default port is not available, then, in the Port Number column, enter a port number.

4. Choose Start.

10.3.6.5 Viewing Directory Server Activities by Using Oracle Enterprise Manager 10g Application Server Control Console

To view directory server activities information:

1. In the Directory Server main window, select the directory server instance whose information you want to view.

2. Choose View Load. The LDAP Load window appears.

3. From the Select Load Characteristics list, select the information that you want to view about this instance. The options are:

   • LDAP Repository Database Sessions—Selecting this option displays two graphs—one for open database sessions, the other for active database sessions at the end of the specified time period of statistics collection.

   • Response Time vs. LDAP Operations—Selecting this option displays two graphs. The first shows the average LDAP operation response time over the course of the specified time period of statistics collection. The other shows the number of operations in progress at the end of that period

   • Active LDAP Sessions vs. New LDAP Sessions—Selecting this option displays two graphs. The first shows the number of active LDAP sessions—that is, those that remain open at the end of the specified time period of statistics collection. The second shows new LDAP sessions—that is, those that are opened over the course of the specified time period of statistics collection.

4. When you have made your selection, choose Go.

10.3.6.6 Viewing Directory Server Operations by Using Oracle Enterprise Manager 10g Application Server Control Console

You can view directory server operations over the course of the specified time period of statistics collection by using Application Server Control Console. To do this:

1. In the Directory Server main window, select the directory server instance whose information you want to view.

2. Choose View Operations. This displays charts for all of the LDAP operations. Click any chart to see a larger image of it.