Thank you for the reply

That makes sense as to why when setting rsyslog as "*.* /var/log/slapd/slapd.log" i would get all the connection msg plus non slapd.

I guess then the question becomes, how can I log those "SEARCH/BIND/RESULT/ect" logs with syslog? Is that possible?

Sep 23 11:28:53 xx slapd[4093535]: 614c9d35.085ebaa4 0x7fccd2e68700 conn=1000 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000020 etime=0.543925 nentries=1 text=
Sep 23 11:28:53 xx slapd[4093535]: 614c9d35.125f76d3 0x7fccd3669700 conn=1000 op=2 UNBIND
Sep 23 11:28:53 xx slapd[4093535]: 614c9d35.1260c23d 0x7fccd3669700 conn=1000 fd=17 closed
Sep 23 11:29:03 xx slapd[4093535]: 614c9d3f.09372be6 0x7fccd2e68700 conn=1005 fd=17 ACCEPT from IP=[xxx]:47720 (IP=[xxx]:389)
Sep 23 11:29:03 xx slapd[4093535]: 614c9d3f.0946ffb3 0x7fccd3669700 conn=1005 op=0 BIND dn="" method=128
Sep 23 11:29:03 xx slapd[4093535]: 614c9d3f.09487362 0x7fccd3669700 conn=1005 op=0 RESULT tag=97 err=0 qtime=0.000028 etime=0.000128 text=
Sep 23 11:29:03 xx slapd[4093535]: 614c9d3f.134838d7 0x7fccd2e68700 conn=1005 op=1 SRCH base="dc=domain,dc=net" scope=2 deref=0 filter="(idnsName=xxx)"
Sep 23 11:29:03 xx slapd[4093535]: 614c9d3f.31f95a03 0x7fccd2e68700 conn=1005 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000032 etime=0.515007 nentries=1 text=
Sep 23 11:29:04 xx slapd[4093535]: 614c9d40.00d3ba3a 0x7fccd3669700 conn=1005 op=2 UNBIND
Sep 23 11:29:04 xx slapd[4093535]: 614c9d40.00d4ee4f 0x7fccd3669700 conn=1005 fd=17 closed

Thank you