SLAPO-AUDITLOG(5)

💖 SLAPO-AUDITLOG(5) 💖

okay bestie, gather round, because today we're talking about slapo-auditlog — the Audit Logging overlay for slapd 🫶 it lives in the File Formats Manual, and it is literally the little diary your directory server keeps about everything that happens to it. no cap.

---

✨ SYNOPSIS ✨

/etc/openldap/slapd.conf

/etc/openldap/slapd.d

---

🌸 DESCRIPTION 🌸

So the Audit Logging overlay? It's giving security camera but for your database 📹✨ You point it at a backend database, you hand it a log file, and it records all the changes that happen there. Every single one. Obsessed.

Changes get logged as standard LDIF, and on top of that there's an extra comment header with six fields of info about the change. Then, because closure is important, a second comment header gets tacked on at the end of the operation to note that the change has terminated. bookend slay 💅

For Add and Modify operations, the identity comes from the modifiersName associated with the operation. Usually that's the same as the requestor's identity, but ngl, other overlays can set it to reflect other values. so don't come for me if it's not who you expected 🙈

---

🎀 CONFIGURATION 🎀

Both slapd.conf and back-config style configuration are supported. yes bestie, both ✨ pick your fighter.

• overlay auditlog — this directive loads the auditlog overlay. that's it. that's the girl. 💖
• auditlog <filename>
• olcAuditlogFile: <filename> — specify the fully qualified path for the log file. like, the whole path, bestie, not just vibes.
• auditlognonblocking {on|off}
• olcAuditlogNonBlocking: {on|off} — opens <filename> in non-blocking mode. highkey useful if <filename> is a named pipe and you need slapd to not just... sit there blocking because no reader is available 😭

---

🔥 COMMENT FIELD INFORMATION 🔥

okay so the first comment header has six fields, in this exact order, and I need you to memorize them because there will be a vibe check:

1. The first field is the operation type.
2. The second field is the timestamp of the operation in seconds since epoch.
3. The third field is the suffix of the database.
4. The fourth field is the recorded modifiersName.
5. The fifth field is the originating IP address and port.
6. The sixth field is the connection number. A connection number of -1 indicates an internal slapd operation. (that's the "no thoughts, head empty, internal business" case 🧚)

---

🌈 EXAMPLE 🌈

The following LDIF could be used to add this overlay to cn=config (adjust to suit — pls don't copy paste blindly bestie, customize it 💅):

dn: olcOverlay=auditlog,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /tmp/auditlog.ldif

---

🦋 EXAMPLE CHANGELOG 🦋

look at her go. main character energy fr fr.

# modify 1614223245 dc=example,dc=com cn=admin,dc=example,dc=com IP=[::1]:47270 conn=1002
dn: uid=joepublic,ou=people,dc=example,dc=com
changetype: modify
replace: displayName
displayName: Joe Public
-
replace: entryCSN
entryCSN: 20210225032045.045229Z#000000#001#000000
-
replace: modifiersName
modifiersName: cn=admin,dc=example,dc=com
-
replace: modifyTimestamp
modifyTimestamp: 20210225032045Z
-
# end modify 1614223245

see how the first comment header says what went down, and the # end modify at the bottom closes it out? ✨ that's the two comment headers doing their thing. iconic.

---

🍓 FILES 🍓

• /etc/openldap/slapd.conf — default slapd configuration file
• /etc/openldap/slapd.d — default slapd configuration directory

---

👑 SEE ALSO 👑

slapd.conf(5), slapd-config(5).

go read those too, bestie, I'm not joking, iykyk 📚

---

⚠️ quick reminder: this whole page is about the slapo-auditlog Audit Logging overlay. Don't confuse it with anything that isn't the Audit Logging overlay. periodt. 💅

---

and that's the whole page, babes 🫶 this was OpenLDAP 2.7.2, dated 2026/10/21 — see you in the next one, mwah 💖✨