Antw: Need help unpicking stats logging

["Ulrich Windl" <Ulrich.Windl@rz.uni-regensburg.de>]

>>> Philip Colmer <philip.colmer@linaro.org> schrieb am 01.04.2016 um 12:45 in
Nachricht
<CAKTSSTgD6zqMBmCckfWEcZFCK1KbtixkWkq-aLRB67pY8oe1rw@mail.gmail.com>:
> I've currently got stats logging turned on while I try to troubleshoot
> an application and I've noticed some rather strange searches going on.
> Strange in that the searches are for very high uidNumber values or for
> uid values that don't exist ... suggesting that someone might be
> trying to grab data from our server.
> 
> What I'm struggling with is trying to figure out from the logs (a) the
> IP address that these queries are coming from and/or (b) the
> authenticated account being used (even if anonymous).
> 
> For example, if I have a log line like this:
> 
> conn=1928683 op=24 SRCH base="ou=accounts,dc=linaro,dc=org" scope=2
> deref=0 
> filter="(&(uid=tftp)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))
> ))"
> 
> is there anything I can do with the conn or op values to connect that
> particular search query to an earlier logged BIND log entry?

I guess "conn=1928683" is the primary key for a connection on this run of slapd ;-)

> 
> Or is there a different/better way for me to try and get the
> information I'm after?
> 
> Thanks.
> 
> Philip