Aaron Bennett wrote:

I’m curious what people think about best practices for cn=monitor in production environments. Do people generally keep it enabled? Is there a drawback to keeping it enabled? Are there any specific security or performance concerns?

I have always enabled it equipped with appropriate ACLs.

Ciao, Michael.