Help to find out clients making heavy queries?

Question

Hello friends,
I have given a task to identify clients making heavy queries on directory server, but I don't understand where to start. Could you help me that how can I identify or list out such clients that connect to my directory server (SunOne DS 5.2)? Is it possible to list them out using access logs and etime (elapsed time) values? Please suggest some way. Many thanks!
Edited by: KPJangid on Nov 23, 2012 3:02 AM

Answer 1

If you look through the access log you will see entries for a connection, followed shortly (usually) by a BIND.
The CONNECT line contains the IP address of the incoming connection, and the BIND the DN used to bind.
There are several potential problems you will have to face:
* If the connections are long-lived (days/weeks) the logs will have rolled, and unless you keep your logs for a long time, finding the original connection and bind might not be possible. Even if it is possible, you may have to look through several GB of data to find it.
* If you have a load balancer/proxy, you may see the address of the load balancer/proxy rather than that of the client system.
* There is often a tendency to re-use BIND credentials, so multiple applications may use the same bind DN making it impossible to identify the application by its bind DN.
* Application servers often use a common connection pool for multiple applications, so even knowing the IP address of the system may not pinpoint the application.
If you can do it - no proxy/load balancer hiding the source IP, it may be easier to snoop the network and look at the addresses on the packets.
Also look at what sorts of requests are being made, that can help to identify the application.
There is no easy way to do this unless some thought went into the original configuration: choosing load balancer which pass the source IP, using unique bind credentials for each application, logfile preservation etc.
All that said, with perseverence it is usually possible to track down the culprit.
Whether it is possible to fix the culprit is usually a political question and often the end result is having to work on the LDAP systems to have them support the heavy clients (using load balance rules to send these requests/applications to dedicated servers etc).