The Last Access Time plugin is used to record the timestamp of the last activity targeting an entry. The plugin updates the ds-last-access-time attribute of the entry when it is accessed by an add, bind, compare, modify, modify DN, or search operation.

The plugin can be used with the Directory Server Uncached Attribute Criteria, or any application that needs to determine how recently an entry has been accessed. The plugin also enables defining request criteria to limit the scope of tracking the last access time. The max-search-result-entries-to-update property also prevents mass updates of ds-last-access-time when searches contain many results, but may not reflect end-user access. Consider the following when using this plugin:
  • The plugin should be enabled on all servers that have the same configuration.
  • An updated ds-last-access-time attribute value is replicated like any other change to an entry.
  • The ds-last-access-time attribute is not returned from a search, unless included in the attributes list explicitly, or given the "+" specification for operational attributes.
  • The ds-last-access-time value format is yyyyMMddHHmmss.SSS'Z', which provides millisecond-level accuracy, such as 20131207144135.821Z.
  • The ds-last-access-time attribute can be indexed with a local database index. The ordering index type is the most relevant, but may require a higher index entry limit (default is 4000) to accommodate searches for entries that have not been accessed in a long period of time. The ordering index type, with a short time range or high index entry limit, will result in indexed search results for requests such as (ds-last-access-time>=20131207144135.821Z).
Important: For deployments earlier than version 4.5 that use the Last Access Time plugin, disable the plugin before upgrading, and then re-enable it after the update is complete. If servers are running different versions, the last-access-time updates might occur with a higher frequency than intended.