UCS 2.4 - Univention

7 UCS Directory service
Logging of the LDAP changes is effected by a Univention directory listener module. The univention-
directory-listener service should be restarted if changes are made to the Univention Configuration Reg-
istry.
7.2.2 Format of the log file
Changes to the directory service are documented in the /var/log/univention/directory-logger.log
file as a series of data records in the following format:
START
Old hash:
DN:
ID:
Modifier:
Time stamp:
Action:
Old values:
New values:
END
There are three types of changes:
• For added entries (add), only the New Values section appears.
• For changed entries (modify), both the New Values section and the Old Values section appear.
• For deleted entries (delete), only the Old Values section appears.
A hash sum is calculated for each logged data record and documented as a line in the daemon.info
section of the Syslog service in the following format:
directory_logger:
DN=
ID=
Modifier=
Timestamp=
New Hash=
The new hash sum is also saved in the /var/lib/univention-directory-logger/cache file to
allow further rotation of the directory-logger.log via Logrotate. Both files are saved in such a way
that read access is limited to the root Posix user and the adm Posix group.
As each data record contains the hash value of the old data record, manipulations of the log file - such as
deleted entries - can be uncovered.
7.3 Timeout for inactive LDAP connections
The LDAP server accepts 1024 connections as standard. When many clients create connections which
they only use sporadically, the point may come when the LDAP server cannot accept any more connec-
182