Subject: RE: Changelog entries draft. Do not seem to find it.

From: "James Benedict" <[email-masked]>
Date: Thu, 2 Mar 2000 08:32:29 -0500

Changelogs seem to be falling between the cracks (LDAP, LDUP, 
LCUP?).  The concept of changelogs is important to replication, but it also
has many other uses.

Accountability (Who did what? When?)
Problem Tracking (Why is my email address X)
Recovery (Whoops, I didn't really want to rename everyone in my directory)
Client-side caching (Give me all the changes to a subtree)

If LDUP is going to subsume the role of maintaining changes for replication
purposes, then I think it is important to make sure that mechanisms are 
in place to deal with these other uses as well.  Otherwise, I think
changelogs should become part of the LDAP standard, not just informational.

It doesn't really matter how the directory server maintains this
information, but clients need to have a consistent way of accessing it.

James A Benedict
Advisor, IP Directory Systems Architecture
Preside Policy Services
NORTEL NETWORKS
Ph:  (613) 763-3909

> -----Original Message-----
> From: Kurt D. Zeilenga [mailto:[email-masked]]
> Sent: Wednesday, March 01, 2000 1:30 PM
> To: [email-masked]
> Cc: Natarajan SK; [email-masked]; Savitha R;
> [email-masked]
> Subject: Re: Changelog entries draft. Do not seem to find it.
> 
> 
> At 10:04 AM 3/1/00 -0800, Gordon Good wrote:
> >While I'm happy to resurrect the changelog draft and discuss 
> publishing it as a standards-track document (informational,
> >probably), it's not going to be a part of  the LDUP specification.
> 
> I would support publication of the Changelog draft as an
> Informational RFC as it would document existing practices.
> The document would have to be amended, of course, to contain
> appropriate statements concerning IETF work in this area.
> 
> Kurt
>

---

From: "Howard Chu" <[email-masked]>
Date: Thu, 2 Mar 2000 06:14:31 -0800

RE: Changelog entries draft. Do not seem to find it.The ChangeLog spec isn't
sufficient for "Accountability" purposes. It isn't flexible enough to
provide a full audit of all operations; since it only records successful
changes it doesn't address binds, searches, compares, etc... It doesn't
record who did an operation. The changeNumber mechanism is problematic. I
started talking to Gordon about using it for these purposes, but after he
pointed out its limitations I decided to let it drop. I came up with
something similar for our own audit log purposes.

If you're interested, here's a quick summary:
  requestId: <timestamp>;<sequence number>
  requestUser: the bindDN that was in effect, or "(anonymous)"
  requestDn: the DN of interest to the operation, if any
  requestType: add/bind/compare/delete/etc...
  requestResult: numeric result code [, number of results returned by
search]
  requestParameters: free format field. For a typical search, this could
contain e.g.
     scope: 2
     filter: (objectclass=*)
     attrs: objectclass
     attrs: cn
The requestParameters attribute gets treated as a binary object...

I have auditing configured both globally and on a per-subtree (slapd
backend) basis, with "audit (none|mod|all)" - "audit mod" is essentially
just a changelog, "audit all" adds bind, compare, search, and unbind.
(Sorry, y'all probably aren't interested in implementation details here, but
it seemed like a simple example was warranted.)
  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc

  -----Original Message-----
  From: James Benedict [mailto:[email-masked]]
  Sent: Thursday, March 02, 2000 5:32 AM
  To: Kurt D. Zeilenga; [email-masked]
  Cc: Natarajan SK; [email-masked]; Savitha R; [email-masked]
  Subject: RE: Changelog entries draft. Do not seem to find it.

  Changelogs seem to be falling between the cracks (LDAP, LDUP,
  LCUP?).  The concept of changelogs is important to replication, but it
also has many other uses.

  If LDUP is going to subsume the role of maintaining changes for
replication
  purposes, then I think it is important to make sure that mechanisms are
  in place to deal with these other uses as well.  Otherwise, I think
  changelogs should become part of the LDAP standard, not just
informational.

  James A Benedict