Derek Yarnell writes: > So a while back we had to go away form stats (256) level debugging > because it was spiking our Spunk traffic so much and go to stat2 > (512). Even now 1 days worth of LDAP logs on one replica is 1.5G. > Now the problem is that stat2 never gives a way to map the connection > to a host. Is there anyway to do this? We seem to have one host that > might be misbehaving in the amounts of ldap queries it is making but I > can't exactly pin point it.
I don't think so. You could remove most Statslog()s from the OpenLDAP source. Or log with level 256 to a pipe to a program which massages the log down to a manageable size. (log to "|program" in syslog.conf, or slapd -d 256 2>&1 >/dev/null | program.) A variant would be to use loglevel 256 or 256+512, log to local files, and filter them for some messages to upload to Spunk (whatever that is). Rotate the local files, retaining them for debugging for some time. -- Hallvard
