Understanding Connect Log Format of Symantec Directory
Article ID: 273033
Updated On:
Products
Issue/Introduction
You may be interested in knowing what all parameters/values that are written to DSA's connect log, if configured. Please keep in mind, connect log is not defined out of the box when a DSA is created.
Unfortunately, not every log (there are ~14 logs per DSA that can be configured) description on each and every thing that get written to it, is available. If that is what you are after, it will be a product documentation enhancement request.
What we do provided is detailed information on each column of stats log which can be useful depending what you are looking for. See 'Additional Information' section below.
See under section of "Statistics Tracing" at:
https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/directory/14-1/administrating/monitor-the-directory/monitoring-with-traces.html
Environment
Release : 14.1
Resolution
As far as connect log goes, it is kind of self-explanatory.
Here is an example from a connect log with some connection activities that basically shows things such as:
- Time up to milliseconds (1st column)
- Connection being made (tagged with CONN)
- Connection ID (should be same for each CONN/DISC, so it can be tracked for auditing)
- How the connection was made (none represents anonymous bind - showing ANON at the end - while for authenticate bind it shows the actual user DN value)
- IP address of where (which node/host) the connection is requested from.
- Protocol in use (if it is over SSL, you will see the that at the end of the CONN line).
- Connection being terminated (tagged with DISC)
- Length of connection (time in seconds)
- Total amount of data being transmitted on that connection (in KB). e.g. search/modify/add/delete etc.
- Total amount of operations performed (in numeric)
- Percentage of CPU usage.
<<snippet from sample democorp_connect_20233031.log>>
[252] 20230831.102942.684 CONN #000 (none) 10.10.10.102:54865 ANON
[200] 20230831.103013.607 DISC #000 (none) 31 sec 15 kbytes 23 ops 0 cpu
[100] 20230831.125051.112 CONN #111 (none) 10.10.10.102:51463 ANON
[196] 20230831.125051.115 DISC #111 (none) 0 sec 0 kbytes 2 ops 0 cpu
[48] 20230831.141755.774 CONN #222 "cn=<UserName>,ou=Administration,ou=Corporate,o=democorp,c=au" 10.10.10.102:53599 PASS
[140] 20230831.141805.493 DISC #222 "cn=<UserName>,ou=Administration,ou=Corporate,o=democorp,c=au" 10 sec 0 kbytes 3 ops 0 cpu
[156] 20230831.141928.734 CONN #333 "cn=<UserName>,ou=Administration,ou=Corporate,o=democorp,c=au" 10.10.10.102:53615 PASS(SSL: TLSv1.2)
[248] 20230831.141943.660 DISC #333 "cn=<UserName>,ou=Administration,ou=Corporate,o=democorp,c=au" 15 sec 0 kbytes 3 ops 0 cpu
Additional Information
See under section of "Statistics Tracing" at:
Feedback
