Auditing Tool for Directory Server

[Dhiraj Deshpande]

Hi Guys,

Is there any auditing tool available for 389 directory server. For e.g to
fetch inactive users from last 8 days,user's last login..etc.

AdAudit does the same but works only with windows active directory which
fetches all these related information from AD.

Kindly let me know if there is any such tool which suffice this requirement.

[William Brown]

On Mon, 2016-05-16 at 09:05 +0530, Dhiraj Deshpande wrote:
> Hi Guys,
>
> Is there any auditing tool available for 389 directory server. For e.g to
> fetch inactive users from last 8 days,user's last login..etc.

Some of these are attributes on the user's object, so you can just query these. The data is there, you just need to put it
together.

You likely need to write something custom, just because only *you* know your requirements for what you need audited.

Sorry I couldn't help more.
> AdAudit does the same but works only with windows active directory which
> fetches all these related information from AD.
>
> Kindly let me know if there is any such tool which suffice this requirement.
>
> --
> 389-users mailing list
> [e-mail]
> http://lists.fedoraproject.org/admin/lists/[e-mail]

[Dhiraj Deshpande]

Hi William,

I tried querying that but not able to convert the timestamp format into
IST. Can you please post one example query for one user's last login time
to be converted.

Thanks
Dhiraj

On Mon, May 16, 2016 at 9:15 AM, William Brown  wrote:
> On Mon, 2016-05-16 at 09:05 +0530, Dhiraj Deshpande wrote:
> > Hi Guys,
> >
> > Is there any auditing tool available for 389 directory server. For e.g to
> > fetch inactive users from last 8 days,user's last login..etc.
>
> Some of these are attributes on the user's object, so you can just query
> these. The data is there, you just need to put it
> together.
>
> You likely need to write something custom, just because only *you* know
> your requirements for what you need audited.
>
> Sorry I couldn't help more.
> > AdAudit does the same but works only with windows active directory which
> > fetches all these related information from AD.
> >
> > Kindly let me know if there is any such tool which suffice this
>
> requirement.
> > --
> > 389-users mailing list
> > [e-mail]
>
> http://lists.fedoraproject.org/admin/lists/[e-mail]
>
> --
> Sincerely,
>
> William Brown
> Software Engineer
> Red Hat, Brisbane
>
> --
> 389-users mailing list
> [e-mail]
>
> http://lists.fedoraproject.org/admin/lists/[e-mail]

[William Brown]

On Mon, 2016-05-16 at 10:00 +0530, Dhiraj Deshpande wrote:
> Hi William,
>
> I tried querying that but not able to convert the timestamp format into
> IST. Can you please post one example query for one user's last login time
> to be converted.

Can you post what attribute you are looking at, that way I know what the correct time format is.

[Dhiraj Deshpande]

For e.g x user's lastlogon information.

ntUserLastLogon: 131064093305375272

Need to convert it into IST.

On Tue, May 17, 2016 at 4:13 AM, William Brown  wrote:
> On Mon, 2016-05-16 at 10:00 +0530, Dhiraj Deshpande wrote:
> > Hi William,
> >
> > I tried querying that but not able to convert the timestamp format into
> > IST. Can you please post one example query for one user's last login time
> > to be converted.
>
> Can you post what attribute you are looking at, that way I know what the
> correct time format is.
>
> --
> Sincerely,
>
> William Brown
> Software Engineer
> Red Hat, Brisbane
>
> --
> 389-users mailing list
> [e-mail]
>
> http://lists.fedoraproject.org/admin/lists/[e-mail]

[William Brown]

On Wed, 2016-05-18 at 08:24 +0530, Dhiraj Deshpande wrote:
> For e.g x user's lastlogon information.
>
> ntUserLastLogon: 131064093305375272
>
> Need to convert it into IST.

http://social.technet.microsoft.com/wiki/contents/articles/22461.understandi...
stamp-and-lastlogondate.aspx

This should help you. That value is winsynced from AD as I understand it, so you can look up what the syntax of the AD lastLogon
value is.

[Dhiraj Deshpande]

Thanks William, that helped.

On Wed, May 18, 2016 at 8:40 AM, William Brown  wrote:
> On Wed, 2016-05-18 at 08:24 +0530, Dhiraj Deshpande wrote:
> > For e.g x user's lastlogon information.
> >
> > ntUserLastLogon: 131064093305375272
> >
> > Need to convert it into IST.
>
> http://social.technet.microsoft.com/wiki/contents/articles/22461.understandi...
> stamp-and-lastlogondate.aspx
>
> This should help you. That value is winsynced from AD as I understand it,
> so you can look up what the syntax of the AD lastLogon
> value is.
>
> --
> Sincerely,
>
> William Brown
> Software Engineer
> Red Hat, Brisbane
>
> --
> 389-users mailing list
> [e-mail]
>
> http://lists.fedoraproject.org/admin/lists/[e-mail]