Hello,
I find sometimes order of event in openldap logs as: BIND RESULT ACCEPT SRCH base SRCH attr= SEARCH RESULT closed
Configured rsyslog as: $template myTemplate,"%timegenerated:::date-rfc3339% %timereported:::date-rfc3339% %msg%\n" local4.* /var/log/rsyslog.log;myTemplate
But I believe correct order should be: Accept Bind result srch base unbind closed
What cant be the reason, is it related to openldap logging mechanism or Logger rsyslog.