# LDAP load while auditbeat collects event.category iam

**URL:** https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200
**Category:** Beats
**Tags:** auditbeat
**Created:** [March 21, 2022, 11:37am UTC](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200 "2022-03-21T11:37:14Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![alchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alchy/32/47743_2.png) [@alchy](https://discuss.elastic.co/u/alchy)
#### Post date: [March 21, 2022, 11:37am UTC](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200/1 "2022-03-21T11:37:14Z")

</div>

We have been dealing with the fact that twice a day we have a heavily loaded LDAP server that manages user accounts in the Unix world.

The situation occurs regularly every day around 8:30 in the morning and 8:30 in the evening, when the LDAP is overwhelmed with requests and the response time multiplies. The condition lasts around 20 minutes, then returns to normal.

This has a direct effect on the response times when logging into the servers, and in fact on everything that reaches for user data in general - so it is possible that it more or less affects the operation of applications.

By quickly checking out a few servers at the "problem" time it seems auditbeat is the cause as the timestamps correlates with pooling of "event.category: iam".

![image](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f69ff8801bac25cd2795f13bb8b3a71f49b53b60.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/3/33a2c3da70d44be5668f16b234dc658641d20a3b.png)

Is it possible to distribute auditbeat (user) queries randomly per server so the whole infrastructure won't DDOS LDAP server?

ie:

```auto
  # How often datasets send state updates with the
  # current state of the system (e.g. all currently
  # running processes, all open sockets).
  state.period: 12h -> "randomly 1x per day" or "randomly 1x per week"

```

thank you

- jindrich

---

<div class="post-metadata">

### Author: ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200/2 "2022-03-21T15:04:49Z")

</div>

I don't think that there is a quick option to adjust it, which isn't a hack. Could you please double-check if this is the audiobeat? For example, rescheduling its execution. If you can confirm the problem, you can open an issue for Beats.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2022, 5:05pm UTC](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200/3 "2022-04-18T17:05:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.