What is eDirectory & NSS Auditing?

eDirectory & NSS Auditing is the OpenText directory services and file system integration component for LT Auditor ^MP. It enables LT Auditor ^MP to receive and process audit activity from two distinct OpenText technologies — OpenText eDirectory and OpenText OES NSS (NetWare Storage Services) — providing the same centralized monitoring, alerting, and compliance reporting capabilities for OpenText environments that other modules provide for Windows and cloud environments.

This component is particularly relevant for organizations that run mixed environments where OpenText eDirectory serves as the LDAP directory service alongside or instead of Microsoft Active Directory, and where OpenText OES servers host NSS file system volumes containing business-critical or sensitive data.

OpenText eDirectory:

OpenText eDirectory is an enterprise-grade LDAP directory service used by many organizations — particularly those with legacy NetWare infrastructure or those in education, government, and healthcare sectors — to manage user identities, authentication, and access control. eDirectory auditing captures changes and access events within the directory, including:

• User account creation, modification, and deletion
• Object creation, modification, deletion, and renaming
• Group membership and security equivalence changes
• Password changes
• LDAP authentication events
• Attribute value changes across directory objects

OpenText OES NSS (NetWare Storage Services):

OES NSS is the high-performance file system used on OpenText Open Enterprise Server (OES) Linux servers. NSS volumes are commonly used as enterprise file storage in organizations running OES infrastructure. NSS auditing captures file system activity on these volumes, including:

• File and folder reads, writes, and deletions
• File and folder creation and renaming
• Permission and trustee assignment changes
• Volume-level activity

How eDirectory & NSS Auditing works:

LT Auditor ^MP via syslog directly from the OpenText systems themselves. LT Auditor ^MP listens for incoming syslog streams on dedicated ports and processes the data through transformation rules configured in the platform.

Default port assignments:

These ports can be changed in the LT Auditor ^MP console under Configure → Transformation Rules if they conflict with other services in your environment.

Data flow:

1. eDirectory and OES NSS servers are configured to forward audit events via syslog to the LT Auditor ^MP server
2. LT Auditor ^MP receives the syslog streams on the configured ports
3. Transformation rules normalize the incoming data into structured audit records
4. Processed events are stored in the LT Auditor ^MP database and become available in the dashboard, View module, alerts, and reports

Key capabilities include:

• Real-time collection of eDirectory object and attribute change events
• Monitoring of LDAP authentication activity across eDirectory servers
• Collection of NSS file system activity from OES Linux servers
• Support for UDP, TCP, and TLS syslog transport protocols
• Configurable transformation rules for normalizing incoming log data
• Integration with LT Auditor ^MP alerting, reporting, and compliance frameworks
• Support for compliance reporting under HIPAA, GDPR, NIS2, ISO 27001, and other frameworks

Common use cases:

• Monitoring unauthorized modifications to eDirectory objects and attributes
• Tracking privileged account changes in eDirectory environments
• Auditing file access and modification on NSS volumes hosting sensitive data
• Detecting suspicious authentication patterns in eDirectory
• Producing compliance evidence for HIPAA, GDPR, and other frameworks in OpenText environments
• Bridging the gap between OpenText and Windows/cloud monitoring in mixed environments

How eDirectory & NSS Auditing fits into LT Auditor ^MP:

eDirectory & NSS Auditing extends LT Auditor ^MP ‘s coverage into OpenText infrastructure, ensuring that organizations running mixed environments have the same level of visibility across their OpenText systems as they do across Windows, Linux, and cloud environments. Events collected from eDirectory and NSS appear in the same dashboards, alert rules, and compliance reports as data from all other modules.

[Your administrator should confirm which eDirectory servers and OES NSS volumes are in scope for monitoring in your environment, and identify the appropriate person to configure the syslog forwarding settings on the OpenText systems themselves.]