Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running openldap 2.4.21 on ubuntu server 10.04 and trying to enable the accesslog overlay using the cn=config configuration style (so not slapd.conf). My main database is olcDatabase={1}hdb so I defined the following module:

/etc/ldap/slapd.d/cn=config/cn=module{2}.ldif

# accesslog overlay definitions for primary db
dn: olcOverlay=accesslog,olcDatabase={1}hdb
objectClass: olcOverlayConfig
objectClass: olcAccessLogConfig
olcOverlay: accesslog
olcAccessLogDB: cn=accesslog
olcAccessLogOps: writes
olcAccessLogSuccess: TRUE
# scan the accesslog DB every day, and purge entries older than 7 days
olcAccessLogPurge: 07+00:00 01+00:00

I got these configuration directives from this page so I'm assuming they are good. When I start slapd I get the below errors:

Nov 30 07:10:17 server slapd[11604]: UNKNOWN attributeDescription "OLCACCESSLOGDB" inserted.
Nov 30 07:10:17 server slapd[11604]: UNKNOWN attributeDescription "OLCACCESSLOGOPS" inserted.
Nov 30 07:10:17 server slapd[11604]: UNKNOWN attributeDescription "OLCACCESSLOGSUCCESS" inserted.
Nov 30 07:10:17 server slapd[11604]: UNKNOWN attributeDescription "OLCACCESSLOGPURGE" inserted.
Nov 30 07:10:17 server slapd[11604]: config error processing olcOverlay=accesslog,olcDatabase={1}hdb,cn=config: 

It looks to me like I'm missing a schema, however when I search for a schema containing the aforementioned attributes I find nothing

$ grep -iR "LOGDB" /etc/ldap/schema/
-

Can someone tell me what I'm missing please?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Looks like you misunderstood what the Accesslog overlay does. It writes access information of one db to another db. So if you are trying to monitor access to {1}hdb, you will have to setup a second database where accesslog will write the information.

Create a directory called accesslog under /var/lib/ldap/

mkdir /var/lib/ldap/accesslog
chown -R openldap:openldap /var/lib/ldap/accesslog

Then use the following ldif to setup the second database

dn: olcDatabase={2}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap/accesslog
olcSuffix: cn=accesslog
olcRootDN: cn=root,dc=yourdomain,dc=com
olcDbIndex: default eq
olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart
share|improve this answer

I bet you did write those attributes IN CAPITAL LETTERS. OpenLDAP is not a big fan of YELLING, but appreciates case-sensitive attributes.

So, for example, instead of OLCACCESSLOGDB use olcAccessLogDB.

share|improve this answer
    
No I did not, the attributes are written in camel case as shown in my sample module file. The camel case syntax is what's used for other slapd.d configuration files which run fine so I would be surprised if that was the problem. –  user64204 Nov 30 '11 at 7:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.