LDAP Change Log

[William Froning <wfroning@aus.edu>]

Hello All,

I was wondering how you all are monitoring Zimbra LDAP change events. I can't seem to find the right log (if it is even enabled) to watch for account changes that might suggest a compromised account. 

We are running 7.2.1. Any assistance is welcome.

Thanks,
Will

-- 
Will Froning
Information Security Manager
Office of the Vice Chancellor for Finance and Administration


American University of Sharjah

Tel +971 6 515 2124
Mob +971 50 737 1599
Fax +971 6 515 2120
PO Box 26666, Sharjah
United Arab Emirates
http://www.aus.edu
wfroning@aus.edu