ITS#5269 fixes from Guillaume Rousse at inria.fr

[openldap] / doc / man / man5 / slapo-accesslog.5

diff --git a/doc/man/man5/slapo-accesslog.5 b/doc/man/man5/slapo-accesslog.5
index 031784662a5ef23f8765b2f85f97b86cf669ff6b..947b8fefdc41bfe2fe0147ccfc70af3a29c9b5d4 100644 (file)
--- a/doc/man/man5/slapo-accesslog.5
+++ b/doc/man/man5/slapo-accesslog.5
@@ -1,9 +1,9 @@
 .TH SLAPO-ACCESSLOG 5 "RELEASEDATE" "OpenLDAP LDVERSION"
-.\" Copyright 2005-2006 The OpenLDAP Foundation All Rights Reserved.
+.\" Copyright 2005-2007 The OpenLDAP Foundation All Rights Reserved.
 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
 .\" $OpenLDAP$
 .SH NAME
-slapo-accesslog \- Access Logging overlay
+slapo-accesslog \- Access Logging overlay to slapd
 .SH SYNOPSIS
 ETCDIR/slapd.conf
 .SH DESCRIPTION
@@ -25,10 +25,11 @@ directive.
 .TP
 .B logdb <suffix>
 Specify the suffix of a database to be used for storing the log records.
-The specified database must have already been configured in a prior section
-of the config file. The suffix entry of the log database will be created
-automatically by this overlay. The log entries will be generated as the
-immediate children of the suffix entry.
+The specified database must be defined elsewhere in the configuration.
+The access controls
+on the log database should prevent general access. The suffix entry
+of the log database will be created automatically by this overlay. The log
+entries will be generated as the immediate children of the suffix entry.
 .TP
 .B logops <operations>
 Specify which types of operations to log. The valid operation types are
@@ -54,6 +55,12 @@ Specify a filter for matching against Deleted and Modified entries. If
 the entry matches the filter, the old contents of the entry will be
 logged along with the current request.
 .TP
+.B logoldattr <attr> ...
+Specify a list of attributes whose old contents are always logged in
+Modify and ModRDN requests. Usually only the contents of attributes that were
+actually modified will be logged; by default no old attributes are logged
+for ModRDN requests.
+.TP
 .B logpurge <age> <interval>
 Specify the maximum age for log entries to be retained in the database,
 and how often to scan the database for old entries. Both the
@@ -88,11 +95,6 @@ succeed or not. The default is FALSE.
 .SH EXAMPLES
 .LP
 .nf
-       database bdb
-       suffix cn=log
-       \...
-       index reqStart eq
-
        database bdb
        suffix dc=example,dc=com
        \...
@@ -100,6 +102,13 @@ succeed or not. The default is FALSE.
        logdb cn=log
        logops writes reads
        logold (objectclass=person)
+
+       database bdb
+       suffix cn=log
+       \...
+       index reqStart eq
+       access to *
+         by dn.base="cn=admin,dc=example,dc=com" read
 .fi
 
 .SH SCHEMA
@@ -109,7 +118,7 @@ overlay utilizes the "audit" schema described herein.
 This schema is specifically designed for
 .B accesslog
 auditing and is not intended to be used otherwise.  It is also
-noted that the schema describe here is
+noted that the schema described here is
 .I a work in
 .IR progress ,
 and hence subject to change without notice.
@@ -318,10 +327,10 @@ attribute: value
 .PD
 The
 .B reqOld
-attribute is only populated if the entry being deleted matches the filter
-in the
-.B logoldfilter
-configuration.
+attribute is only populated if the entry being deleted matches the
+configured
+.B logold
+filter.
 
 .LP
 .RS 4
@@ -342,10 +351,10 @@ optionally contain the previous contents of any modified attributes in the
 attribute, using the same format as described above for the Delete operation.
 The
 .B reqOld
-attribute is only populated if the entry being modified matches the filter
-in the
-.B logoldfilter
-configuration.
+attribute is only populated if the entry being modified matches the
+configured
+.B logold
+filter.
 
 .LP
 .RS 4
@@ -354,7 +363,7 @@ configuration.
     DESC 'ModRDN operation'
     SUP auditWriteObject STRUCTURAL
     MUST ( reqNewRDN $ reqDeleteOldRDN )
-    MAY reqNewSuperior )
+    MAY ( reqNewSuperior $ reqOld ) )
 .RE
 .P
 The
@@ -373,6 +382,14 @@ The
 .B reqNewSuperior
 attribute carries the DN of the new parent entry if the request specified
 the new parent.
+The
+.B reqOld
+attribute is only populated if the entry being modified matches the
+configured
+.B logold
+filter and contains attributes in the
+.B logoldattr
+list.
 
 .LP
 .RS 4