We have 389 Directory Server logs and I was wondering if there is a way to monitor for failed authentication attempts? The error code for a failed attempt is err=49 in the log, but the actual username for the failed attempt is on another line. I can't find a good way to search for the uid's with failed logins.
[12/May/2015:15:59:38 +0000] conn=43278605 op=0 BIND dn="uid=todd,ou=people,dc=example,dc=net" method=128 version=3
[12/May/2015:15:59:38 +0000] conn=43278605 op=0 RESULT err=49 tag=97 nentries=0 etime=0
I want to be able to see that "uid=todd" when there is an instance of err=49.
... View more