filter="(?=undefined)"

[Nei Venturini dos Santos <nsantos@procergs.rs.gov.br>]

Hi, I have an OpenLDAP2.1.4-119 instaled on a SuSE Linux 8.1 and there are 
some searches that are loading my server a lot. On the output of "top", I 
can find the pid of the LDAP process/thread that is overloading the 
machine, so that when looking for that pid in the file slapd.log I find the 
following line: 
Oct 7 16:25:28 athens slapd[26209]: conn=1370 op=74 SRCH 
base="o=ESTADO,c=BR" scope=2 filter="(?=undefined)" 
I can't find the search that is generating the "(?=undefined)" entry. 
I have searched the archieves and notice that most of the "undefined logs" 
are problems related with schema definition, then I fond another query that 
generates an "undefined log", but it does not increase the cpu load. The 
log entry is: 
Oct 7 11:39:11 athens slapd[13245]: conn=88666 op=1138 SRCH 
base="o=ESTADO,c=BR" scope=2 
filter="(&(?=undefined)(objectClass=diretoPersonalContact)(ownerUid=gg-equipededesenvolvimento))" 
In this case I can identify that the "undefined" attribute on the query was 
the mail attribute which is defined in the core.schema like this: 
attributetype ( 0.9.2342.19200300.100.1.3 
NAME ( 'mail' 'rfc822Mailbox' ) 
DESC 'RFC1274: RFC822 Mailbox' 
EQUALITY caseIgnoreIA5Match 
SUBSTR caseIgnoreIA5SubstringsMatch 
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) 

So my doubt is: which query could generate that behavior? 
How can I identify the queries that my users are doing that generate the 
"undefined" entry in the log? 

Thanks in advance 


Nsantos