extract-data-recovery-log-changes

Description

Extracts changes matching a given set of criteria from a Directory Server audit log so that they may be replayed (for example, as part of a disaster recovery process) or reverted (for example, to back out changes made in error).

This tool is designed to be used in conjunction with the server's data recovery log files (in the logs/data-recovery directory). It may be used in conjunction with other audit log files, but for best results, the logger should be configured to operate in reversible form, to include the requester DN and IP address, and to include information about any intermediate client control that may have been provided in the request.

This tool must not be used with a log file that the server may update while the tool is running, or that may have some content stored in an unwritten buffer (which is especially likely if the log is compressed or encrypted). To use this tool with the server online, you should only specify a log file that has already been rotated to ensure that no more writes will be made to that file. If necessary, you may use the rotate-log tool to force the current active file to be rotated.

To use this tool to revert an inappropriate set of changes, run it with '--direction revert' and an additional set of arguments that identify which changes should be reverted (for example, based on the address of the client, the authorization DN of the requester, the time frame in which the changes were applied, etc.).

To use this tool to replay changes that were previously applied (for example, after restoring an old backup or importing an old LDIF file), run it with '--direction replay' and an appropriate set of arguments to select the desired set of changes. Also, make sure to use 'dsreplication pre-external-initialization' before performing the restore or import and applying the changes, and then use 'dsreplication post-external-initialization' after the changes have been applied. See the Directory Server Administration Guide for additional information.

This tool will extract changes from the selected log file (and any previously rotated files, unless the --doNotFollowRotationChain argument is provided) and output them in LDIF change format. If the --outputFile argument is provided, then the changes will be written to that file; otherwise, they will be written to standard output. If changes are to be written to a file, then the output will be compressed if the input files were compressed (unless the --doNotCompressOutput argument was provided), and the output will be encrypted if the input files were encrypted (unless --doNotEncryptOutput was provided). You may wish to first run the tool without specifying an output file so that you can verify that the selected change are correct. Once you are certain that the appropriate changes have been selected, then you can use a tool like ldapmodify or parallel-update to apply those changes to the server.

Examples

extract-data-recovery-log-changes --direction replay --startTime 20180101000000 \
     --changeType add --changeType modify --outputFile extracted-changes.ldif

extract-data-recovery-log-changes \
     --auditLogFile logs/data-recovery/data-recovery.20180102030405Z.gz.encrypted \
     --direction revert \
     --includeAuthorizationDN "cn=Bad Client,ou=Applications,dc=example,dc=com" \
     --includeAddressMask 1.2.3.4 --outputFile extracted-changes.ldif \
     --failureLogFile extract-failures.log

Arguments

-V
--version

-H
--help

--help-debug

--auditLogFile {path}

--auditLogEncryptionPassphraseFile {path}

--doNotFollowRotationChain

--outputFile {path}

--outputFileEncryptionPassphraseFile {path}

--doNotCompressOutput

--doNotEncryptOutput

--failureLogFile {path}

--direction {replay|revert}

--changeType {add|delete|modify|modify-dn}

--excludeSubtreeDeletes

--excludeSoftDeletes

--excludeUndeletes

--excludeDeletesOfSoftDeletedEntries

--excludeModifiesOfSoftDeletedEntries

--startTime {timestamp}

--endTime {timestamp}

--includeAddressMask {address-mask}

--excludeAddressMask {address-mask}

--ignoreDownstreamAddresses

--includeConnectionID {connection-id}

--excludeConnectionID {connection-id}

--includeDownstreamConnectionID {connection-id}

--excludeDownstreamConnectionID {connection-id}

--includeAuthenticationDN {dn}

--excludeAuthenticationDN {dn}

--includeAuthorizationDN {dn}

--excludeAuthorizationDN {dn}

--includeChangesWithOrigin {origin}

--excludeChangesWithOrigin {origin}

--includeChangesWithAnyOrigin

--excludeChangesWithAnyOrigin

--includeTargetEntryBaseDN {dn}

--excludeTargetEntryBaseDN {dn}

--includeChangesFromPrivateBackends

--includeAddOperationsMatchingFilter {filter}

--excludeAddOperationsMatchingFilter {filter}

--includeDeleteOperationsMatchingFilter {filter}

--excludeDeleteOperationsMatchingFilter {filter}

--includeModifyOperationsTargetingAttribute {attribute}

--excludeModifyOperationsTargetingAttribute {attribute}

--includeOnlyAttributeInAdd {attribute}

--excludeAttributeFromAdd {attribute}

--includeOnlyModificationsToAttribute {attribute}

--excludeModificationsToAttribute {attribute}

--suppressOperationalAttributesFromAdd {all|none|no-user-modification}

--suppressOperationalAttributesFromModify {all|none|no-user-modification}

--suppressRequestControl {control-name}

--interactive

--propertiesFilePath {path}

--generatePropertiesFile {path}

--noPropertiesFile

--suppressPropertiesFileComment