Ben Beuchler writes:
Apr 10 13:14:39 swizzle slapd[5944]: connection_input: conn=1696 deferring operation: binding
Include 256 in your loglevel, if you haven't already, and look for the '<date> swizzle slapd[<pid>]: conn=<num> ...' lines it produces. In particular, look for 'conn=<num> op=<num> RESULT' lines _after_ the 'deferring operation' line, where the matched received operation (same conn and op) was _before_ that line. Notice what the operation was, and what the result code was (RESULT ... err=). You'll find the result code descriptions in RFC 4511.
Note that logging is a bit sloppy - for requests with syntax errors or some other problems, only the response is logged. But since these requests fail without processing they shouldn't take time either.