Hello,

I find sometimes order of event in openldap logs as:
BIND
RESULT
ACCEPT
SRCH base
SRCH attr=
SEARCH RESULT
closed

Configured rsyslog as:
$template myTemplate,"%timegenerated:::date-rfc3339% %timereported:::date-rfc3339% %msg%\n"
local4.*                                                /var/log/rsyslog.log;myTemplate

But I believe correct order should be:
Accept
Bind
result
srch base
unbind
closed

What cant be the reason, is it related to openldap logging mechanism or Logger rsyslog.
 
-- 
Thanks
Amit