[389-users] Re: SIEM Audit Data

user authentication errors are usually recorded on the client end. On Thu, Oct 13, 2016 at 4:47 PM, Jason Nielsen wrote: > Im looking for ways to pull a number of audit events from 389. Such as: > > -User authentication success and failures. > -Group additions, removals and

[389-users] SIEM Audit Data

Im looking for ways to pull a number of audit events from 389. Such as: -User authentication success and failures. -Group additions, removals and changes. -User additions, removals and possibly changes. Details in each of these would include items such as: username groupname attribute changed