Linux Networking Cookbook

12.12. Configuring OpenLDAP Logging

Problem

OpenLDAP's default setup dumps logging into the syslog, and you would rather it have its own separate logfile. How do you do this?

Solution

First, we'll create a separate directory and an empty logfile:

	# mkdir /var/log/openldap
	# touch /var/log/openldap/ldap.log

Then, add these lines to /etc/syslog.conf:

	#Logging for openldap
	local4.* /var/log/openldap/ldap.log

And set your desired logging level in slapd.conf, in the Global section:

	loglevel             256

Now, restart both OpenLDAP and the syslog daemon:

	# /etc/init.d/slapd restart (Debian)
	# /etc/init.d/ldap restart (Fedora)
	# /etc/init.d/sysklogd restart (Debian)
	# /etc/init.d/syslog restart (Fedora)

Run some searches to generate some activity, then check your logfile. It should be full of entries like this:

	May 22 11:53:32 xena slapd[7686]: conn=5 fd=11 ACCEPT from IP=127.0.0.1:33643 (IP=0.
	0.0.0:389)
	May 22 11:53:32 xena slapd[7686]: conn=5 op=0 BIND dn="" method=128
	May 22 11:53:32 xena slapd[7686]: conn=5 op=0 RESULT tag=97 err=0 text=
	May 22 11:53:32 xena slapd[7686]: conn=5 op=1 SRCH base="dc=alrac,dc=net" scope=2
	deref=0 filter="(objectClass=*)"

Discussion

The available logging levels for OpenLDAP are a bit complicated. man 5 slapd.conf lists all of them. The default is 256, which logs statistics like connections, operations, and results. -1 logs everything, so beware! A busy OpenLDAP server will generate megabytes of logfiles at this level in no time. Some admins disable logging entirely with ...