DirX Directory DSA LDAP Extended Operations Reference Descriptions

dsa_ac_log_on [parameter1; parameter2; …​]

Enables access control (AC) logging.

parameter1; parameter2; …​
One or more parameters to restrict the logging output to the information that is relevant to a particular type of operation. Specify the parameter in the format:

parameter_name=parameter_value

Use a semicolon (;) to separate multiple parameters.

There are two types of parameter:

Non-volatile parameters are stored and are in effect while the DSA process is running. They are updated only when the operation is called with the same parameter. Volatile parameters are in effect only for the extended operation to which they are attached.

The following table provides the name, the type, a description and the default value for each parameter:

Use the dsa_ac_log_on LDAP extended operation to enable a special AC logging. This logging is useful for analysis of the effects of the configured access control items contributing to an access control decision.

On success, the DSA returns the string AC logging is successfully enabled.

The resulting log file is an ASCII textfile written to install_path*/server/log*. The name of the log file is:

DSA_ACpid.file_number

Use the parameters to restrict the logging to the information that is relevant to a particular type of operation.

In the following example, access control logging is enabled for the entry cn=Digger,ou=Development,o=My-Company. Access control logging is enabled for filterMatch, browse, and read operations:

On success, the LDAP extended operation returns the message:

Here is a snippet from a log file written after the command above has been performed successfully:

dsa_ac_log_off, dirxextop in the DirX Directory Administration Reference, Attributes Controlling LDAP Extended Operations in the DirX Directory Syntaxes and Attributes, X.500 Security Features in the DirX Directory Introduction.

dsa_ac_log_off

Disables access control (AC) logging.

Use the dsa_ac_log_off LDAP extended operation to disable the AC logging.

On success, the DSA returns the string AC logging is successfully disabled.

Existing log files are preserved in the log folder. If logging is enabled again logging is continued in the next file of the round robin sequence.

The following example access control logging is disabled:

On success, the LDAP extended operation returns the message:

AC logging is successfully disabled

dsa_ac_log_on, dirxextop in the DirX Directory Administration Reference, Attributes Controlling LDAP Extended Operations in the DirX Directory Syntaxes and Attributes, X.500 Security Features in the DirX Directory Introduction.

dsa_dbam_aac help |
    list [bt=begin_time et=end_time] |
    reset [all] |
    show [index] |
    start [bt=begin_time interval=interval_spec [no_of_intervals]] |
    status |
    stop

Manages the DBAM AVIDX access counter (AAC) statistic histories. In the AAC statistic histories, the DSA records how often an attribute index is used in search operations.

The AAC statistic histories consist of a permanent statistic history with the index 0 and up to 54 statistic histories with the indexes 1 through 54. In the permanent statistic history, the DSA permanently records how often an attribute index is used in search operations. All other statistic histories are overwritten when the maximum number of statistics (54 statistics) is exceeded (first in first out) or a reset, start or stop command is performed.

The AAC statistic histories help an administrator to manage the attribute indexes and optimize the performance of search operations. For example, the administrator can identify attribute indexes that are never used and can then delete these attribute indexes.

Returns help information about the dsa_dbam_aac extended operation and its commands. The syntax is as follows:

dsa_dbam_aac help

Lists available AAC statistics histories. The syntax is as follows:

dsa_dbam_aac list [*bt=*begin_time *et=*end_time]

Discontinues the maintenance of AAC statistics histories. The syntax is as follows:

dsa_dbam_aac reset [all]

Displays the counters of a specific ACC statistic history. The syntax is as follows:

dsa_dbam_aac show [index]

Directs DBAM to start a new AAC statistic history. The syntax is as follows:

dsa_dbam_aac start [*bt=*begin_time *interval=*interval_spec [no_of_intervals]]

Returns the current status of the AAC statistic history configuration. The syntax is as follows:

dsa_dbam_aac status

Stops AAC statistic history collection. The syntax is as follows:

dsa_dbam_aac stop

The dsa_dbam_aac LDAP extended operation allows DirX Directory administrators to manage the recording of AAC statistic histories. In the AAC statistic histories, the DSA records how often an attribute index is used in search operations.

The AAC statistic histories help an administrator to administrate the attribute indexes and optimize the performance of search operations. For example, the administrator can identify attribute indexes that are never used and can delete these attribute indexes.

After the DBAM database is initialized, a permanent AAC statistic history is saved into a DBAM block every five minutes. If the DSA crashes, the counter for the last unsaved period is lost.

Use the dsa_dbam_aac status command to find out whether an AAC statistic history is configured.

Use the dsa_dbam_aac start command to initiate a new statistic history. For each new statistic history, DBAM creates a new DBAM statistic history block, resets the counters to zero and records the statistic history start time.

Use the dsa_dbam_aac stop command to stop a statistic history explicitly.

Use the dsa_dbam_aac reset command to stop the statistic history immediately and to remove all AAC statistic histories except for the permanent AAC statistic history.

Use the dsa_dbam_aac list command to get a list of all available AAC statistic histories. Then use the dsa_dbam_aac show command to display the counters of a specific AAC statistic history.

DBAM can keep a maximum of 54 statistic histories. After the 54^th statistic history, DBAM history collection wraps around to the first DBAM statistic history block.

The maximum number of indexed attributes is 800. The permanent AAC statistic history records counters for all attribute indexes. All other AAC statistic histories records counters for maximal 400 attribute indexes.

The following example shows how to apply the dsa_dbam_aac LDAP extended operation with the tool dirxextop. It shows the creation of a scheduled AAC statistic history. The start time is 1 July 2016 at 0:00 AM, the interval is one day and the time span is scheduled for 10 days:

Because dirxextop accepts only one parameter, you must enclose the arguments to the dsa_dbam_aac extended operation in double quotation marks ("").

dirxextop in the DirX Directory Administration Reference, Attributes Controlling LDAP Extended Operations in DirX Directory Syntaxes and Attributes.

dsa_dirxadm_cmd "*dirxadm_command"*

Performs dirxadm operations in a directory service that can only be accessed via LDAP protocol.This extended operation is available only on Linux systems.

"dirxadm_command"
Specifies the dirxadm operation as a simple unencoded string enclosed in double quotes.

Use the dsa_dirxadm_cmd LDAP extended operation to perform a dirxadm operation in a DSA that can only be accessed via LDAP protocol.

On success, the DSA returns the result of the dirxadm operation.

The dsa_dirxadm_cmd operation requires the Execute permission; that is, the user’s distinguished name must be contained in the LDAP Extended Operations Execute Users or LDAP Extended Operations Execute Groups attribute of the LDAP server.

The dsa_dirxadm_cmd operation uses the bind operation specified in the environment variable DIRX_DSA_EXTOP_ADM_BIND to perform the bind operation to the DSA.

In the following example a lob show operation is performed:

On success, the LDAP extended operation returns the following output:

In the following example the paging policy of the root entry is displayed:

On success, the LDAP extended operation returns the following output:

dirxextop and dirxadm in the DirX Directory Administration Reference, Environment Variables in DirX Directory Administration Reference, dirxadm command in the DirX Directory Administration Reference, dse bind operation in the DirX Directory Administration Reference, Attributes Controlling LDAP Extended Operations in the DirX Directory Syntaxes and Attributes, X.500 Security Features in the DirX Directory Introduction.

dsa_relevant_aci [parameter]

Searches for access control subentries that include the specified entry in the user classes.The operation searches only for access control subentries that contain prescriptive access control items.Entry access control items and subentry access control items are not returned.

The result is the list of distinguished names.Every line contains exactly one distinguished name.If Distinguished names containing a new line or a non-printable character are written in base64 encoding.

The distinguished name of the entry can be specified as a parameter using LDAP distinguished name syntax. If no parameter is specified, the result contains the relevant access control subentries for an anonymous bind.

In the following example an access control search is executed for the cn=admin,o=my-company entry:

On success, the LDAP extended operation returns the following output:

In the following example an access control search is executed for an anonymous bind:

On success, the LDAP extended operation returns the following output:

dirxextop in the DirX Directory Administration Reference, Attributes Controlling LDAP Extended Operations in DirX Directory Syntaxes and Attributes, Distinguished Names in DirX Directory String Representation for LDAP Binds in DirX Directory Syntaxes and Attributes.