Add audit json logging design page (#14)

Reviewed by: progier389, vashirov, spichugi (Thanks!!)

docs/389ds/design/audit-json-logging-design.md

@@ -0,0 +1,80 @@
+---
+title: "Audit JSON Logging Design"
+---
+
+# Audit JSON Logging
+----------------
+
+Overview
+--------
+
+In order to make the audit logging more consumable by standard parsing tool it will written in a JSON format instead of using a partial LDIF format which not LDAP compliant in its current form.
+
+While the old format, after a bit of data massaging, could be replayed using a LDAP client (e.g. ldapmodify), this is most likely not used by most customers.  Instead, customers are looking for actual audit information that can by consumed by well known log parsers.
+
+JSON Design
+------------
+
+```
+[
+    {
+        date: <strftime output>
+        target_dn: DN,
+        bind_dn: DN,
+        client: IP_ADDRESS,
+        haproxy: IP_ADDRESS,
+        conn_id: ####,
+        op_id: ####,
+        result: ##,
+        add: {
+            "attr1": [value, value, ...],
+            "attr2": [value, value, ...],
+        },
+        delete: DN,
+        modify: [
+           {
+             op: add/replace/delete,
+             attr: "cn",
+             value: "name",
+           },
+        ],
+        modrdn: {
+            deleteOldRdn: True/False,
+            newRdn: "cn=mark",
+        }
+    },
+    {
+        ...
+    }
+]
+```
+
+Configuration
+------------------------
+
+Add a new configuration setting for audit logging under **cn=config**
+
+```
+nsslapd-auditlog-json-format: on/off
+```
+
+For now set this to "off", but in a next major release it should be set to "on" by default.
+
+When switching to a new logging format the current log will be rotated
+
+You can also adjust the time format using strftime conversion specifications.  The default would be **%FT%TZ**
+
+    nsslapd-auditlog-time-format: {strftime specs}
+
+
+Origin
+-----------------------
+
+<https://github.com/389ds/389-ds-base/issues/6115>
+
+
+Author
+-----------------------
+
+<[email protected]>
+

docs/389ds/design/design.md

@@ -38,6 +38,7 @@ If you are adding a new design document, use the [template](design-template.html
 ## 389 Directory Server 3.0
 
 -   [MFA Operation Note For Auditing](mfa-operation-note-design.html)
+-   [Audit JSON Logging](audit-json-logging-design.html)
 
 ## 389 Directory Server 2.3