Hello, I find sometimes order of event in openldap logs as: BIND RESULT ACCEPT SRCH base SRCH attr= SEARCH RESULT closed Configured rsyslog as: $template myTemplate,"%timegenerated:::date-rfc3339% %timereported:::date-rfc3339% %msg%\n" local4.* /var/log/rsyslog.log;myTemplate But I believe correct order should be: Accept Bind result srch base unbind closed What cant be the reason, is it related to openldap logging mechanism or Logger rsyslog.