Return-Path: <nico@cryptonector.com>
Received: from homiemail-a89.g.dreamhost.com (caiajhbdcbbj.dreamhost.com [208.97.132.119]) by krbdev.mit.edu (Postfix) with ESMTP id 0E5CC3E72B; Mon, 22 Oct 2012 22:48:16 -0400 (EDT)
Received: from homiemail-a89.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a89.g.dreamhost.com (Postfix) with ESMTP id 51FA2318064; Mon, 22 Oct 2012 19:48:15 -0700 (PDT)
Dkim-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:content-type; s=cryptonector.com; bh=hcuIN3BDp8PxYoYN4MMmJro MVkc=; b=L+b5X9C29My5WU/1K6vcQDRyuqO6aibKLhnxWbgCwp8jfkus2KbubAe ilDNJA86q+Yp/7j13F7pAY5GUFTxGfKvwVJAehbdFkeYMJEyTwYJuJ0wxFawgiH9 OW4bQ3BarjxpWF1JMD5gz/69lQVq4EJH7YQ2ZbzclGBAbAleSebA=
Received: from mail-da0-f50.google.com (mail-da0-f50.google.com [209.85.210.50]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a89.g.dreamhost.com (Postfix) with ESMTPSA id 32C92318059; Mon, 22 Oct 2012 19:48:15 -0700 (PDT)
Received: by mail-da0-f50.google.com with SMTP id z20so1770846dae.23 for <multiple recipients>; Mon, 22 Oct 2012 19:48:14 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.68.204.132 with SMTP id ky4mr35273413pbc.164.1350960494760; Mon, 22 Oct 2012 19:48:14 -0700 (PDT)
Received: by 10.68.44.98 with HTTP; Mon, 22 Oct 2012 19:48:14 -0700 (PDT)
In-Reply-To: <CAK3OfOgBj4djgDFjPJvegt52L6GJFrLE9CO5MRGf_qo71gbViA@mail.gmail.com>
References: <rt-7405@krbdev.mit.edu> <rt-7405-36837.16.4223726798262@krbdev.mit.edu> <CAK3OfOgBj4djgDFjPJvegt52L6GJFrLE9CO5MRGf_qo71gbViA@mail.gmail.com>
Date: Mon, 22 Oct 2012 21:48:14 -0500
Message-ID: <CAK3OfOip373YrCXob=ZhR_f4fcJ4f2=wM-vP6+4G9YnGu-8drA@mail.gmail.com>
Subject: Re: [krbdev.mit.edu #7405] All kadm5srv consumers should log writes to the iprop ulog
From: Nico Williams <nico@cryptonector.com>
To: rt-comment@krbdev.mit.edu, rt@krbdev.mit.edu
Content-Type: text/plain; charset=UTF-8
RT-Send-Cc: 
Content-Length: 337

Also, some writers must not log to the ulog, namely: kdb5_util load
(there's no way for it to know if it's a master or not, so assume it's
a master) and kpropd (since it doesn't now, though it does update the
header, of course).  Also, as long as krb5kdc only modifies
non-replicated attributes we might as well not ulog from it either.