Bug 1338872 - Wrong result code display in audit-failure log
Summary: Wrong result code display in audit-failure log
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: pre-dev-freeze
: ---
Assignee: Noriko Hosoi
QA Contact: Viktor Ashirov
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-05-23 14:29 UTC by Kamlesh
Modified: 2016-11-03 20:42 UTC (History)
3 users (show)

Fixed In Version: 389-ds-base-1.3.5.7-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-03 20:42:10 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2594 normal SHIPPED_LIVE Moderate: 389-ds-base security, bug fix, and enhancement update 2016-11-03 12:11:08 UTC

Description Kamlesh 2016-05-23 14:29:19 UTC
Description of problem:
After the modifying entry in DS using the wrong object, it display error on console with error code 32 but in audit-failure log it display result -1 

Version-Release number of selected component (if applicable):
10.3.5.3

How reproducible:
Always 



Steps to Reproduce:
1. ldapmodify -D "cn=Directory Manager" -w test1234 -p 14000 -h test.example.com
dn: uid=test,ou=People,dc=example,dc=com
changetype:modify
replace:sn
sn:balu

2.

3.

Actual results:

modifying entry "uid=test,ou=People,dc=example,dc=com"
ldap_modify: No such object (32)
	matched DN: ou=People,dc=example,dc=com


in Log audit-filure log 
time: 20160523194032
dn: uid=test,ou=People,dc=example,dc=com
result: -1
changetype: modify
replace: sn
sn: balu
-
replace: modifiersname
modifiersname: cn=directory manager
-
replace: modifytimestamp
modifytimestamp: 20160523141032Z


Expected results:

time: 20160523194032
dn: uid=test,ou=People,dc=example,dc=com
result: 32
changetype: modify
replace: sn
sn: balu
-
replace: modifiersname
modifiersname: cn=directory manager
-
replace: modifytimestamp
modifytimestamp: 20160523141032Z

Additional info:

Comment 2 Noriko Hosoi 2016-06-16 17:43:15 UTC
Upstream ticket:
https://fedorahosted.org/389/ticket/48892

Comment 4 Kamlesh 2016-06-28 13:12:19 UTC
Bug Verified 
Steps performs 

[root@test /]# rpm -qa | grep 389-ds
389-ds-base-1.3.5.8-1.el7.x86_64


Step 1) Enable the Audit and Audit Failure log. Fail log update in Audit log file 
[root@test yum.repos.d]# ldapmodify -D "cn=Directory Manager" -h localhost -p 389 -w test1234  << EOF
> dn: cn=config
> changetype: modify
> replace: nsslapd-auditlog-logging-enabled
> nsslapd-auditlog-logging-enabled: on
> -
> replace: nsslapd-auditfaillog-logging-enabled
> nsslapd-auditfaillog-logging-enabled: on
> EOF

Step 2) Add Entry which give no such object error
[root@test yum.repos.d]# ldapmodify -D "cn=Directory Manager" -w test1234 -p 389 -h test.example.com << EOF
> dn: uid=test,ou=People,dc=example,dc=com
> changetype:modify
> replace:sn
> sn: test
> EOF

modifying entry "uid=test,ou=People,dc=example,dc=com"
ldap_modify: No such object (32)
	matched DN: ou=People,dc=example,dc=com

Log entry in the : /var/log/dirsrv/slapd-test/audit
time: 20160627181142
dn: uid=test,ou=People,dc=example,dc=com
result: 32
changetype: modify
replace: sn
sn: test
-
replace: modifiersname
modifiersname: cn=directory manager
-
replace: modifytimestamp
modifytimestamp: 20160627124142Z
-

Step 3) enable the Audit failure log parameters
[root@test yum.repos.d]# ldapmodify -D "cn=Directory Manager" -h localhost -p 389 -w test1234  << EOF
> dn: cn=config
> changetype: modify
> add: nsslapd-auditfaillog
> nsslapd-auditfaillog: /var/log/dirsrv/slapd-test/audit-failure
> -
> add: nsslapd-auditfaillog-mode
> nsslapd-auditfaillog-mode: 600
> -
> add: nsslapd-auditfaillog-maxlogsize
> nsslapd-auditfaillog-maxlogsize: 1
> -
> add: nsslapd-auditfaillog-logrotationtime
> nsslapd-auditfaillog-logrotationtime: 1
> -
> add: nsslapd-auditfaillog-logrotationtimeunit
> nsslapd-auditfaillog-logrotationtimeunit: Day
> -
> add: nsslapd-auditfaillog-maxlogsperdir
> nsslapd-auditfaillog-maxlogsperdir: 10
> EOF

Step 4) Add Entry which give no such object error
[root@test yum.repos.d]# ldapmodify -D "cn=Directory Manager" -w test1234 -p 389 -h test.example.com << EOF
> dn: uid=test,ou=People,dc=example,dc=com
> changetype:modify
> replace:sn
> sn: test
> EOF

Result : 
modifying entry "uid=test,ou=People,dc=example,dc=com"
ldap_modify: No such object (32)
	matched DN: ou=People,dc=example,dc=com

Log entry in the : /var/log/dirsrv/slapd-test/audit-failure

time: 20160627180025
dn: uid=test,ou=People,dc=example,dc=com
result: 32
changetype: modify
replace: sn
sn: test
-
replace: modifiersname
modifiersname: cn=directory manager
-
replace: modifytimestamp
modifytimestamp: 20160627123025Z

Comment 7 errata-xmlrpc 2016-11-03 20:42:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2594.html


Note You need to log in before you can comment on or make changes to this bug.