The audit log is a specialized version of the access log used for troubleshooting problems that could occur in the course of processing.
The audit log records all changes to directory data in LDIF format so that administrators can quickly diagnose the changes an application made to the data or replay the changes to another server for testing purposes.
The audit log does not record authentication attempts but can be used in conjunction with the access log to troubleshoot security-related issues.
The audit log is disabled by default because it reduces the server’s write performance.
By default, if you enable the audit log on Directory Server, the
authPassword attribute values are
obscured. Each value of an obscured attribute is replaced in the audit log with a string of
"***** OBSCURED VALUE *****". You can unobscure these attributes
by deleting them from the