Derek Yarnell writes:

So a while back we had to go away form stats (256) level debugging because it was spiking our Spunk traffic so much and go to stat2 (512). Even now 1 days worth of LDAP logs on one replica is 1.5G. Now the problem is that stat2 never gives a way to map the connection to a host. Is there anyway to do this? We seem to have one host that might be misbehaving in the amounts of ldap queries it is making but I can't exactly pin point it.

I don't think so. You could remove most Statslog()s from the OpenLDAP source. Or log with level 256 to a pipe to a program which massages the log down to a manageable size. (log to "|program" in syslog.conf, or slapd -d 256 2>&1 >/dev/null | program.)

A variant would be to use loglevel 256 or 256+512, log to local files, and filter them for some messages to upload to Spunk (whatever that is). Rotate the local files, retaining them for debugging for some time.