diff --git a/docs/389ds/design/audit-json-logging-design.md b/docs/389ds/design/audit-json-logging-design.md new file mode 100644 index 0000000..5818745 --- /dev/null +++ b/docs/389ds/design/audit-json-logging-design.md @@ -0,0 +1,80 @@ +--- +title: "Audit JSON Logging Design" +--- + +# Audit JSON Logging +---------------- + +Overview +-------- + +In order to make the audit logging more consumable by standard parsing tool it will written in a JSON format instead of using a partial LDIF format which not LDAP compliant in its current form. + +While the old format, after a bit of data massaging, could be replayed using a LDAP client (e.g. ldapmodify), this is most likely not used by most customers. Instead, customers are looking for actual audit information that can by consumed by well known log parsers. + +JSON Design +------------ + +``` +[ + { + date: + target_dn: DN, + bind_dn: DN, + client: IP_ADDRESS, + haproxy: IP_ADDRESS, + conn_id: ####, + op_id: ####, + result: ##, + add: { + "attr1": [value, value, ...], + "attr2": [value, value, ...], + }, + delete: DN, + modify: [ + { + op: add/replace/delete, + attr: "cn", + value: "name", + }, + ], + modrdn: { + deleteOldRdn: True/False, + newRdn: "cn=mark", + } + }, + { + ... + } +] +``` + +Configuration +------------------------ + +Add a new configuration setting for audit logging under **cn=config** + +``` +nsslapd-auditlog-json-format: on/off +``` + +For now set this to "off", but in a next major release it should be set to "on" by default. + +When switching to a new logging format the current log will be rotated + +You can also adjust the time format using strftime conversion specifications. The default would be **%FT%TZ** + + nsslapd-auditlog-time-format: {strftime specs} + + +Origin +----------------------- + + + + +Author +----------------------- + + + diff --git a/docs/389ds/design/design.md b/docs/389ds/design/design.md index bfd21c4..be37bb2 100644 --- a/docs/389ds/design/design.md +++ b/docs/389ds/design/design.md @@ -38,6 +38,7 @@ If you are adding a new design document, use the [template](design-template.html ## 389 Directory Server 3.0 - [MFA Operation Note For Auditing](mfa-operation-note-design.html) +- [Audit JSON Logging](audit-json-logging-design.html) ## 389 Directory Server 2.3