From df95edbe39150abfae457eee1d06b8cdb2fba51b Mon Sep 17 00:00:00 2001
From: Stanislav Laznicka <slaznick@redhat.com>
Date: Jul 10 2018 14:40:34 +0000
Subject: Issue 49835 - lib389: fix logging


The python standard logging module allows to postpone the string
interpolation in logs till the time the interpolation is actually
needed (note that you may be running in a certain logging level
that won't need to display/write all strings). This behavior is
there to comply with the logging requirement so that logs don't
affect the performance if no logging happens.

The above behavior only works when strings are passed as arguments
to the logging methods. If the interpolation is invoked at place
either by using the `%` notation or by using the `str.format()`
method, python logging can't perform its performance heuristics
since the strings get interpolated before they are handed to the
logging methods.

This commit fixes the improper behavior observed in the lib389
library, plus adds some fixes to improper invokes of the logging
methods - multiple arguments if formatting string does not contain
formatting variables -  which would cause internal logging errors
that don't cause the scripts failures, which is why they probably
weren't reported yet.

https://pagure.io/389-ds-base/issue/49835

Reviewed by: mreynolds, spichugi

Signed-off-by: Simon Pichugin <simon.pichugin@gmail.com>

---

diff --git a/src/lib389/lib389/__init__.py b/src/lib389/lib389/__init__.py
index 2153bc6..5ed9ed5 100644
--- a/src/lib389/lib389/__init__.py
+++ b/src/lib389/lib389/__init__.py
@@ -434,7 +434,7 @@ class DirSrv(SimpleLDAPObject, object):
         self.binddn = binddn
         self.bindpw = password
         self.state = DIRSRV_STATE_ALLOCATED
-        self.log.info("Allocate local instance %s with %s" % (self.__class__, self.ldapuri))
+        self.log.info("Allocate local instance %s with %s", self.__class__, self.ldapuri)
 
     def remote_simple_allocate(self, ldapuri, binddn='cn=Directory Manager', password=None):
         """Allocate an instance, and perform a simple bind. This instance is remote, so
@@ -465,7 +465,7 @@ class DirSrv(SimpleLDAPObject, object):
         self.binddn = binddn
         self.bindpw = password
         self.state = DIRSRV_STATE_ALLOCATED
-        self.log.info("Allocate %s with %s" % (self.__class__, self.ldapuri))
+        self.log.info("Allocate %s with %s", self.__class__, self.ldapuri)
 
     # Should there be an extra boolean to this function to determine to use
     #  ldapi or not? Or does the settings presence indicate intent?
@@ -515,7 +515,7 @@ class DirSrv(SimpleLDAPObject, object):
         self.ldapi_enabled = args.get(SER_LDAPI_ENABLED, 'off')
         self.ldapi_socket = args.get(SER_LDAPI_SOCKET, None)
         self.ldapuri = args.get(SER_LDAP_URL, None)
-        self.log.debug("Allocate %s with %s" % (self.__class__, self.ldapuri))
+        self.log.debug("Allocate %s with %s", self.__class__, self.ldapuri)
         # Still needed in setup, even if ldapuri over writes.
         self.host = args.get(SER_HOST, socket.gethostname())
         self.port = args.get(SER_PORT, DEFAULT_PORT)
@@ -528,7 +528,7 @@ class DirSrv(SimpleLDAPObject, object):
             self.ldapi_autobind = args.get(SER_LDAPI_AUTOBIND, 'off')
             self.isLocal = True
             if self.verbose:
-                self.log.info("Allocate %s with %s" % (self.__class__, self.ldapi_socket))
+                self.log.info("Allocate %s with %s", self.__class__, self.ldapi_socket)
         # Settings from args of server attributes
         self.strict_hostname = args.get(SER_STRICT_HOSTNAME_CHECKING, False)
         if self.strict_hostname is True:
@@ -539,7 +539,7 @@ class DirSrv(SimpleLDAPObject, object):
                 DirSrvTools.searchHostsFile(self.host, None)
             self.isLocal = isLocalHost(self.host)
 
-        self.log.debug("Allocate %s with %s:%s" % (self.__class__, self.host, (self.sslport or self.port)))
+        self.log.debug("Allocate %s with %s:%s", self.__class__, self.host, (self.sslport or self.port))
 
         self.binddn = args.get(SER_ROOT_DN, DN_DM)
         self.bindpw = args.get(SER_ROOT_PW, PW_DM)
@@ -565,10 +565,10 @@ class DirSrv(SimpleLDAPObject, object):
 
         self.state = DIRSRV_STATE_ALLOCATED
         if self.verbose:
-            self.log.info("Allocate %s with %s:%s" % (self.__class__,
-                                                      self.host,
-                                                      (self.sslport or
-                                                       self.port)))
+            self.log.info("Allocate %s with %s:%s",
+                          self.__class__,
+                          self.host,
+                          (self.sslport or self.port))
 
     def clone(self, args_instance={}):
         """
@@ -774,9 +774,9 @@ class DirSrv(SimpleLDAPObject, object):
         if not os.path.isdir(sysconfig_head):
             privconfig_head = None
         if self.verbose:
-            self.log.info("dir (sys) : %s" % sysconfig_head)
+            self.log.info("dir (sys) : %s", sysconfig_head)
         if privconfig_head and self.verbose:
-            self.log.info("dir (priv): %s" % privconfig_head)
+            self.log.info("dir (priv): %s", privconfig_head)
 
         # list of the found instances
         instances = []
@@ -794,9 +794,9 @@ class DirSrv(SimpleLDAPObject, object):
                                                DEFAULT_ENV_HEAD)
                 found = search_dir(instances, pattern, serverid)
                 if self.verbose and len(instances) > 0:
-                    self.log.info("List from %s" % privconfig_head)
+                    self.log.info("List from %s", privconfig_head)
                     for instance in instances:
-                        self.log.info("list instance %r\n" % instance)
+                        self.log.info("list instance %r\n", instance)
                 if found:
                     assert len(instances) == 1
                 else:
@@ -810,9 +810,9 @@ class DirSrv(SimpleLDAPObject, object):
                                                DEFAULT_ENV_HEAD)
                 search_dir(instances, pattern, serverid)
                 if self.verbose and len(instances) > 0:
-                    self.log.info("List from %s" % privconfig_head)
+                    self.log.info("List from %s", privconfig_head)
                     for instance in instances:
-                        self.log.info("list instance %r\n" % instance)
+                        self.log.info("list instance %r\n", instance)
 
         else:
             # all instances must be retrieved
@@ -821,16 +821,16 @@ class DirSrv(SimpleLDAPObject, object):
                                                DEFAULT_ENV_HEAD)
                 search_dir(instances, pattern)
                 if self.verbose and len(instances) > 0:
-                    self.log.info("List from %s" % privconfig_head)
+                    self.log.info("List from %s", privconfig_head)
                     for instance in instances:
-                        self.log.info("list instance %r\n" % instance)
+                        self.log.info("list instance %r\n", instance)
 
             pattern = "%s*" % os.path.join(sysconfig_head, DEFAULT_ENV_HEAD)
             search_dir(instances, pattern)
             if self.verbose and len(instances) > 0:
-                self.log.info("List from %s" % privconfig_head)
+                self.log.info("List from %s", privconfig_head)
                 for instance in instances:
-                    self.log.info("list instance %r\n" % instance)
+                    self.log.info("list instance %r\n", instance)
 
         return instances
 
@@ -862,7 +862,7 @@ class DirSrv(SimpleLDAPObject, object):
         prog = os.path.join(self.ds_paths.sbin_dir, CMD_PATH_SETUP_DS)
 
         if not os.path.isfile(prog):
-            self.log.error("Can't find file: %r, removing extension" % prog)
+            self.log.error("Can't find file: %r, removing extension", prog)
             prog = prog[:-3]
 
         # Create and extract a service keytab
@@ -943,7 +943,7 @@ class DirSrv(SimpleLDAPObject, object):
                                 instance with the same 'serverid'
         """
         # check that DirSrv was in DIRSRV_STATE_ALLOCATED state
-        self.log.debug("Server is in state %s" % self.state)
+        self.log.debug("Server is in state %s", self.state)
         if self.state != DIRSRV_STATE_ALLOCATED:
             raise ValueError("invalid state for calling create: %s" %
                              self.state)
@@ -999,11 +999,11 @@ class DirSrv(SimpleLDAPObject, object):
         if (not self.ds_paths.prefix or self.ds_paths.prefix == '/') and os.geteuid() != 0:
             raise ValueError("Error: without prefix deployment it is required to be root user")
         cmd = "%s -i %s%s" % (prog, DEFAULT_INST_HEAD, self.serverid)
-        self.log.debug("running: %s " % cmd)
+        self.log.debug("running: %s ", cmd)
         try:
             os.system(cmd)
         except:
-            self.log.exception("error executing %r" % cmd)
+            self.log.exception("error executing %r", cmd)
 
         # If this was the last instance being deleted, remove the DEFAULT_USER
         # if lib389 created the default user
@@ -1017,7 +1017,8 @@ class DirSrv(SimpleLDAPObject, object):
                     try:
                         subprocess.call(cmd)
                     except subprocess.CalledProcessError as e:
-                        self.log.exception('Failed to delete default user ' +
+                        self.log.exception(
+                                'Failed to delete default user ',
                                       '(%s): error %s' % (DEFAULT_USER,
                                                           e.output))
 
@@ -1059,7 +1060,7 @@ class DirSrv(SimpleLDAPObject, object):
         if not uri:
             uri = self.toLDAPURL()
 
-        self.log.debug('open(): Connecting to uri %s' % uri)
+        self.log.debug('open(): Connecting to uri %s', uri)
         if hasattr(ldap, 'PYLDAP_VERSION') and MAJOR >= 3:
             super(DirSrv, self).__init__(uri, bytes_mode=False, trace_level=TRACE_LEVEL)
         else:
@@ -1067,7 +1068,7 @@ class DirSrv(SimpleLDAPObject, object):
 
         if certdir is None and self.isLocal:
             certdir = self.get_cert_dir()
-            self.log.debug("Using dirsrv ca certificate %s" % certdir)
+            self.log.debug("Using dirsrv ca certificate %s", certdir)
 
         if certdir is not None:
             """
@@ -1076,20 +1077,20 @@ class DirSrv(SimpleLDAPObject, object):
             # Note this sets LDAP.OPT not SELF. Because once self has opened
             # it can NOT change opts AT ALL.
             self.set_option(ldap.OPT_X_TLS_CACERTDIR, ensure_str(certdir))
-            self.log.debug("Using external ca certificate %s" % certdir)
+            self.log.debug("Using external ca certificate %s", certdir)
 
         if userkey is not None:
             # Note this sets LDAP.OPT not SELF. Because once self has opened
             # it can NOT change opts AT ALL.
-            self.log.debug("Using user private key %s" % userkey)
+            self.log.debug("Using user private key %s", userkey)
             self.set_option(ldap.OPT_X_TLS_KEYFILE, ensure_str(userkey))
 
         if usercert is not None:
-            self.log.debug("Using user certificate %s" % usercert)
+            self.log.debug("Using user certificate %s", usercert)
             self.set_option(ldap.OPT_X_TLS_CERTFILE, ensure_str(usercert))
 
         if certdir is not None:
-            self.log.debug("Using external ca certificate %s" % certdir)
+            self.log.debug("Using external ca certificate %s", certdir)
             self.set_option(ldap.OPT_X_TLS_CACERTDIR, ensure_str(certdir))
 
         if certdir or starttls:
@@ -1097,10 +1098,10 @@ class DirSrv(SimpleLDAPObject, object):
                 # Note this sets LDAP.OPT not SELF. Because once self has opened
                 # it can NOT change opts on reused (ie restart)
                 self.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, reqcert)
-                self.log.debug("Using certificate policy %s" % reqcert)
-                self.log.debug("ldap.OPT_X_TLS_REQUIRE_CERT = %s" % reqcert)
+                self.log.debug("Using certificate policy %s", reqcert)
+                self.log.debug("ldap.OPT_X_TLS_REQUIRE_CERT = %s", reqcert)
             except ldap.LDAPError as e:
-                self.log.fatal('TLS negotiation failed: %s' % str(e))
+                self.log.fatal('TLS negotiation failed: %s', e)
                 raise e
 
         # Tell python ldap to make a new TLS context with this information.
@@ -1125,7 +1126,7 @@ class DirSrv(SimpleLDAPObject, object):
             self.sasl_interactive_bind_s("", sasl_auth)
         elif saslmethod:
             # Unknown or unsupported method
-            self.log.debug('Unsupported SASL method: %s' % saslmethod)
+            self.log.debug('Unsupported SASL method: %s', saslmethod)
             raise ldap.UNWILLING_TO_PERFORM
 
         elif self.can_autobind():
@@ -1144,17 +1145,17 @@ class DirSrv(SimpleLDAPObject, object):
                 self.simple_bind_s(ensure_str(self.binddn), self.bindpw)
             except ldap.SERVER_DOWN as e:
                 # TODO add server info in exception
-                self.log.debug("Cannot connect to %r" % uri)
+                self.log.debug("Cannot connect to %r", uri)
                 raise e
             except ldap.LDAPError as e:
-                self.log.debug("Error: Failed to authenticate: %s", str(e))
+                self.log.debug("Error: Failed to authenticate: %s", e)
                 raise e
 
         """
         Authenticated, now finish the initialization
         """
         if self.verbose:
-            self.log.info("open(): bound as %s" % self.binddn)
+            self.log.info("open(): bound as %s", self.binddn)
         if not connOnly:
             self.__initPart2()
         self.state = DIRSRV_STATE_ONLINE
@@ -1298,20 +1299,20 @@ class DirSrv(SimpleLDAPObject, object):
             # TODO: use the status call instead!!!!
             pid = pid_from_file(self.ds_paths.pid_file)
             if pid is None:
-                self.log.debug("No pidfile found for %s" % self.serverid)
+                self.log.debug("No pidfile found for %s", self.serverid)
                 # No pidfile yet ...
                 self.state = DIRSRV_STATE_OFFLINE
                 return False
             if pid == 0:
-                self.log.debug("Pid of 0 not valid for %s" % self.serverid)
+                self.log.debug("Pid of 0 not valid for %s", self.serverid)
                 self.state = DIRSRV_STATE_OFFLINE
                 raise ValueError
             # Wait
             if not pid_exists(pid):
-                self.log.debug("Pid of %s is not running for %s" % (pid, self.serverid))
+                self.log.debug("Pid of %s is not running for %s", pid, self.serverid)
                 self.state = DIRSRV_STATE_OFFLINE
                 return False
-            self.log.debug("Pid of %s for %s and running" % (pid, self.serverid))
+            self.log.debug("Pid of %s for %s and running", pid, self.serverid)
             return True
 
     def restart(self, timeout=120, post_open=True):
@@ -1359,7 +1360,7 @@ class DirSrv(SimpleLDAPObject, object):
                 try:
                     os.remove(backup_file)
                 except:
-                    self.log.info("clearBackupFS: fail to remove %s" % backup_file)
+                    self.log.info("clearBackupFS: fail to remove %s", backup_file)
                     pass
         else:
             backup_dir, backup_pattern = self._infoBackupFS()
@@ -1368,7 +1369,7 @@ class DirSrv(SimpleLDAPObject, object):
                 try:
                     os.remove(f)
                 except:
-                    self.log.info("clearBackupFS: fail to remove %s" % backup_file)
+                    self.log.info("clearBackupFS: fail to remove %s", backup_file)
                     pass
 
     def checkBackupFS(self):
@@ -1463,15 +1464,15 @@ class DirSrv(SimpleLDAPObject, object):
 
                 for b_dir in dirs:
                     name = os.path.join(root, b_dir)
-                    self.log.debug("backupFS b_dir = %s (%s) [name=%s]" %
-                              (b_dir, self.ds_paths.prefix, name))
+                    self.log.debug("backupFS b_dir = %s (%s) [name=%s]",
+                                   b_dir, self.ds_paths.prefix, name)
                     if prefix_pattern:
                         name = re.sub(prefix_pattern, '', name)
 
                     if os.path.isdir(name):
                         listFilesToBackup.append(name)
-                        self.log.debug("backupFS add = %s (%s)" %
-                                  (name, self.ds_paths.prefix))
+                        self.log.debug("backupFS add = %s (%s)",
+                                       name, self.ds_paths.prefix)
 
                 for file in files:
                     name = os.path.join(root, file)
@@ -1480,8 +1481,8 @@ class DirSrv(SimpleLDAPObject, object):
 
                     if os.path.isfile(name):
                         listFilesToBackup.append(name)
-                        self.log.debug("backupFS add = %s (%s)" %
-                                  (name, self.ds_paths.prefix))
+                        self.log.debug("backupFS add = %s (%s)",
+                                       name, self.ds_paths.prefix)
 
         # create the archive
         name = "backup_%s_%s.tar.gz" % (self.serverid, time.strftime("%m%d%Y_%H%M%S"))
@@ -1491,7 +1492,7 @@ class DirSrv(SimpleLDAPObject, object):
         for name in listFilesToBackup:
             tar.add(name)
         tar.close()
-        self.log.info("backupFS: archive done : %s" % backup_file)
+        self.log.info("backupFS: archive done : %s", backup_file)
 
         # return to the directory where we were
         os.chdir(here)
@@ -1514,7 +1515,7 @@ class DirSrv(SimpleLDAPObject, object):
             self.log.warning("Unable to restore the instance (missing backup)")
             raise ValueError("Unable to restore the instance (missing backup)")
         if not os.path.isfile(backup_file):
-            self.log.warning("Unable to restore the instance (%s is not a file)" %
+            self.log.warning("Unable to restore the instance (%s is not a file)",
                         backup_file)
             raise ValueError("Unable to restore the instance " +
                              "(%s is not a file)" % backup_file)
@@ -1524,26 +1525,26 @@ class DirSrv(SimpleLDAPObject, object):
         #
 
         # previous db (it may exists new db files not in the backup)
-        self.log.debug("restoreFS: remove subtree %s/*" % os.path.dirname(self.dbdir))
+        self.log.debug("restoreFS: remove subtree %s/*", os.path.dirname(self.dbdir))
         for root, dirs, files in os.walk(os.path.dirname(self.dbdir)):
             for d in dirs:
                 if d not in ("bak", "ldif"):
-                    self.log.debug("restoreFS: before restore remove directory" +
-                              " %s/%s" % (root, d))
+                    self.log.debug("restoreFS: before restore remove directory"
+                                   " %s/%s", root, d)
                     shutil.rmtree("%s/%s" % (root, d))
 
         # previous error/access logs
-        self.log.debug("restoreFS: remove error logs %s" % self.errlog)
+        self.log.debug("restoreFS: remove error logs %s", self.errlog)
         for f in glob.glob("%s*" % self.errlog):
-            self.log.debug("restoreFS: before restore remove file %s" % (f))
+            self.log.debug("restoreFS: before restore remove file %s", f)
             os.remove(f)
-        self.log.debug("restoreFS: remove access logs %s" % self.accesslog)
+        self.log.debug("restoreFS: remove access logs %s", self.accesslog)
         for f in glob.glob("%s*" % self.accesslog):
-            self.log.debug("restoreFS: before restore remove file %s" % (f))
+            self.log.debug("restoreFS: before restore remove file %s", f)
             os.remove(f)
         log.debug("restoreFS: remove audit logs %s" % self.accesslog)
         for f in glob.glob("%s*" % self.auditlog):
-            self.log.debug("restoreFS: before restore remove file %s" % (f))
+            self.log.debug("restoreFS: before restore remove file %s", f)
             os.remove(f)
 
         # Then restore from the directory where DS was deployed
@@ -1563,13 +1564,13 @@ class DirSrv(SimpleLDAPObject, object):
                 # It could be a bad idea and preferably restore all.
                 # Now it will be easy to enhance that function.
                 if os.access(member.name, os.W_OK):
-                    self.log.debug("restoreFS: restored %s" % member.name)
+                    self.log.debug("restoreFS: restored %s", member.name)
                     tar.extract(member.name)
                 else:
-                    self.log.debug("restoreFS: not restored %s (no write access)" %
-                              member.name)
+                    self.log.debug("restoreFS: not restored %s (no write access)",
+                                   member.name)
             else:
-                self.log.debug("restoreFS: restored %s" % member.name)
+                self.log.debug("restoreFS: restored %s", member.name)
                 tar.extract(member.name)
 
         tar.close()
@@ -1580,10 +1581,10 @@ class DirSrv(SimpleLDAPObject, object):
         guardian_file = os.path.join(self.dbdir, "guardian")
         if os.path.isfile(guardian_file):
             try:
-                self.log.debug("restoreFS: remove %s" % guardian_file)
+                self.log.debug("restoreFS: remove %s", guardian_file)
                 os.remove(guardian_file)
             except:
-                self.log.warning("restoreFS: fail to remove %s" % guardian_file)
+                self.log.warning("restoreFS: fail to remove %s", guardian_file)
                 pass
 
         os.chdir(here)
@@ -1799,7 +1800,7 @@ class DirSrv(SimpleLDAPObject, object):
             XXX This cannot return None
         """
         if self.verbose:
-            self.log.debug("Retrieving entry with %r" % [args])
+            self.log.debug("Retrieving entry with %r", [args])
         if len(args) == 1 and 'scope' not in kwargs:
             args += (ldap.SCOPE_BASE, )
 
@@ -1807,10 +1808,10 @@ class DirSrv(SimpleLDAPObject, object):
         restype, obj = self.result(res)
         # TODO: why not test restype?
         if not obj:
-            raise NoSuchEntryError("no such entry for %r" % [args])
+            raise NoSuchEntryError("no such entry for %r", [args])
 
         if self.verbose:
-            self.log.info("Retrieved entry %s" % obj)
+            self.log.info("Retrieved entry %s", obj)
         if isinstance(obj, Entry):
             return obj
         else:  # assume list/tuple
@@ -1821,13 +1822,13 @@ class DirSrv(SimpleLDAPObject, object):
     def _test_entry(self, dn, scope=ldap.SCOPE_BASE):
         try:
             entry = self.getEntry(dn, scope)
-            self.log.info("Found entry %s" % entry)
+            self.log.info("Found entry %s", entry)
             return entry
         except NoSuchEntryError:
-            self.log.exception("Entry %s was added successfully, but I cannot " +
-                          "search it" % dn)
-            raise MissingEntryError("Entry %s was added successfully, but " +
-                                    "I cannot search it" % dn)
+            self.log.exception("Entry %s was added successfully, but I cannot ",
+                               "search it" % dn)
+            raise MissingEntryError("Entry %s was added successfully, but "
+                                    "I cannot search it", dn)
 
     def __wrapmethods(self):
         """This wraps all methods of SimpleLDAPObject, so that we can intercept
@@ -1865,7 +1866,7 @@ class DirSrv(SimpleLDAPObject, object):
                 except ldap.LDAPError as e:
                     if not self.cont:
                         raise e
-                    self.log.exception("Error: could not add entry %s" % dn)
+                    self.log.exception("Error: could not add entry %s", dn)
 
         adder = LDIFAdder(input_file, self, cont)
 
@@ -2091,8 +2092,8 @@ class DirSrv(SimpleLDAPObject, object):
                       "userdn = \"ldap:///%s\";)" % binddn)
             self.modify_s(suffix, [(ldap.MOD_ADD, 'aci', [acival])])
         except ldap.TYPE_OR_VALUE_EXISTS:
-            self.log.error("proxy aci already exists in suffix %s for %s" % (
-                suffix, binddn))
+            self.log.error("proxy aci already exists in suffix %s for %s",
+                           suffix, binddn)
 
     def setupChaining(self, to, suffix, isIntermediate):
         """Setup chaining from self to to - self is the mux, to is the farm
@@ -2176,7 +2177,7 @@ class DirSrv(SimpleLDAPObject, object):
         try:
             self.add_s(ent)
         except ldap.ALREADY_EXISTS:
-            self.log.warn("Entry %s already exists" % binddn)
+            self.log.warn("Entry %s already exists", binddn)
 
         try:
             entry = self._test_entry(binddn, ldap.SCOPE_BASE)
@@ -2259,8 +2260,8 @@ class DirSrv(SimpleLDAPObject, object):
                 # weird, internal error we do not retrieve the default
                 # replication bind DN this replica agreement will fail
                 # to update the consumer until the property will be set
-                self.log.warning("createAgreement: binddn not provided and " +
-                            "default value unavailable")
+                self.log.warning("createAgreement: binddn not provided and "
+                                 "default value unavailable")
                 pass
 
         # get the RA binddn password
@@ -2272,8 +2273,8 @@ class DirSrv(SimpleLDAPObject, object):
                 # replication bind DN password this replica agreement
                 # will fail to update the consumer until the property will be
                 # set
-                self.log.warning("createAgreement: bindpw not provided and " +
-                            "default value unavailable")
+                self.log.warning("createAgreement: bindpw not provided and "
+                                 "default value unavailable")
                 pass
 
         # get the RA bind method
@@ -2284,8 +2285,8 @@ class DirSrv(SimpleLDAPObject, object):
                 # weird, internal error we do not retrieve the default
                 # replication bind method this replica agreement will
                 # fail to update the consumer until the property will be set
-                self.log.warning("createAgreement: bindmethod not provided and " +
-                            "default value unavailable")
+                self.log.warning("createAgreement: bindmethod not provided and "
+                                 "default value unavailable")
                 pass
 
         nsuffix = normalizeDN(suffix)
@@ -2357,7 +2358,7 @@ class DirSrv(SimpleLDAPObject, object):
             self.setupWinSyncAgmt(args, entry)
 
         try:
-            self.log.debug("Adding replica agreement: [%s]" % entry)
+            self.log.debug("Adding replica agreement: [%s]", entry)
             self.add_s(entry)
         except:
             #  TODO check please!
@@ -2441,13 +2442,13 @@ class DirSrv(SimpleLDAPObject, object):
                         replicated = True
                         break
                 except ldap.LDAPError as e:
-                    self.log.fatal('testReplication() failed to modify (%s), error (%s)' % (suffix, str(e)))
+                    self.log.fatal('testReplication() failed to modify (%s), error (%s)', suffix, e)
                     return False
                 loop += 1
                 time.sleep(2)
             if not replicated:
-                self.log.fatal('Replication is not in sync with replica server (%s)'
-                          % replica.serverid)
+                self.log.fatal('Replication is not in sync with replica server (%s)',
+                               replica.serverid)
                 return False
 
         return True
@@ -2512,7 +2513,7 @@ class DirSrv(SimpleLDAPObject, object):
                 })
             self.setupBindDN(*attrs)
         except ldap.ALREADY_EXISTS:
-            self.log.warn("User already exists: %r " % user)
+            self.log.warn("User already exists: %r ", user)
 
         # setup replica
         # map old style args to new style replica args
@@ -2719,7 +2720,7 @@ class DirSrv(SimpleLDAPObject, object):
 
                 return
 
-        self.log.fatal('Failed to clear tmp directory (%s)' % filename)
+        self.log.fatal('Failed to clear tmp directory (%s)', filename)
 
     def upgrade(self, upgradeMode):
         """
@@ -2757,7 +2758,7 @@ class DirSrv(SimpleLDAPObject, object):
             return False
 
         if not os.path.isfile(import_file):
-            self.log.error("ldif2db: Can't find file: %s" % import_file)
+            self.log.error("ldif2db: Can't find file: %s", import_file)
             return False
 
         cmd = [
@@ -2784,8 +2785,8 @@ class DirSrv(SimpleLDAPObject, object):
         try:
             result = subprocess.check_output(cmd, encoding='utf-8')
         except subprocess.CalledProcessError as e:
-            self.log.debug("Command: {} failed with the return code {} and the error {}".format(
-                           format_cmd_list(cmd), e.returncode, e.output))
+            self.log.debug("Command: %s failed with the return code %s and the error %s",
+                           format_cmd_list(cmd), e.returncode, e.output)
             return False
 
         self.log.debug("ldif2db output: BEGIN")
@@ -2852,8 +2853,8 @@ class DirSrv(SimpleLDAPObject, object):
         try:
             result = subprocess.check_output(cmd, encoding='utf-8')
         except subprocess.CalledProcessError as e:
-            self.log.debug("Command: {} failed with the return code {} and the error {}".format(
-                           format_cmd_list(cmd), e.returncode, e.output))
+            self.log.debug("Command: %s failed with the return code %s and the error %s",
+                           format_cmd_list(cmd), e.returncode, e.output)
             return False
 
         self.log.debug("db2ldif output: BEGIN")
@@ -2888,8 +2889,8 @@ class DirSrv(SimpleLDAPObject, object):
                 '-D', self.get_config_dir()
             ], encoding='utf-8')
         except subprocess.CalledProcessError as e:
-            self.log.debug("Command: {} failed with the return code {} and the error {}".format(
-                           format_cmd_list(cmd), e.returncode, e.output))
+            self.log.debug("Command: %s failed with the return code %s and the error %s",
+                           format_cmd_list(cmd), e.returncode, e.output)
             return False
 
         self.log.debug("bak2db output: BEGIN")
@@ -2926,8 +2927,8 @@ class DirSrv(SimpleLDAPObject, object):
                 '-D', self.get_config_dir()
             ], encoding='utf-8')
         except subprocess.CalledProcessError as e:
-            self.log.debug("Command: {} failed with the return code {} and the error {}".format(
-                           format_cmd_list(cmd), e.returncode, e.output))
+            self.log.debug("Command: %s failed with the return code %s and the error %s",
+                           format_cmd_list(cmd), e.returncode, e.output)
             return False
 
         self.log.debug("db2bak output: BEGIN")
@@ -2989,8 +2990,8 @@ class DirSrv(SimpleLDAPObject, object):
         try:
             result = subprocess.check_output(cmd, encoding='utf-8')
         except subprocess.CalledProcessError as e:
-            self.log.debug("Command: {} failed with the return code {} and the error {}".format(
-                           format_cmd_list(cmd), e.returncode, e.output))
+            self.log.debug("Command: %s failed with the return code %s and the error %s",
+                           format_cmd_list(cmd), e.returncode, e.output)
             return False
 
         self.log.debug("db2index output: BEGIN")
@@ -3015,7 +3016,7 @@ class DirSrv(SimpleLDAPObject, object):
                 json_item = [backup, bak_date, bak_size]
                 json_result['items'].append(json_item)
             else:
-                self.log.info('Backup: {} - {} ({})'.format(bak, bak_date, bak_size))
+                self.log.info('Backup: %s - %s (%s)', bak, bak_date, bak_size)
 
         if use_json:
             print(json.dumps(json_result))
@@ -3026,7 +3027,7 @@ class DirSrv(SimpleLDAPObject, object):
         # Delete backup directory
         bakdir = self.get_bak_dir()
         del_dir = bakdir + "/" + bak_dir
-        self.log.debug("Deleting backup directory: " + del_dir)
+        self.log.debug("Deleting backup directory: ", del_dir)
         shutil.rmtree(del_dir)
 
     def dbscan(self, bename=None, index=None, key=None, width=None, isRaw=False):
@@ -3074,7 +3075,7 @@ class DirSrv(SimpleLDAPObject, object):
 
         self.stop(timeout=10)
 
-        self.log.info('Running script: %s' % cmd)
+        self.log.info('Running script: %s', cmd)
         output = subprocess.check_output(cmd)
 
         self.start(timeout=10)
@@ -3278,8 +3279,8 @@ class DirSrv(SimpleLDAPObject, object):
                     gid = grp.getgrnam(self.userid).gr_gid
                     os.chown(ldif_file, uid, gid)
             except OSError as e:
-                self.log.exception('Failed to create ldif file (%s): error %d - %s' %
-                              (ldif_file, e.errno, e.strerror))
+                self.log.exception('Failed to create ldif file (%s): error %d - %s',
+                                   ldif_file, e.errno, e.strerror)
                 raise e
 
     def getConsumerMaxCSN(self, replica_entry):
@@ -3302,8 +3303,8 @@ class DirSrv(SimpleLDAPObject, object):
         try:
             consumer.open()
         except ldap.LDAPError as e:
-            self.log.debug('Connection to consumer (%s:%s) failed, error: %s' %
-                           (host, port, str(e)))
+            self.log.debug('Connection to consumer (%s:%s) failed, error: %s',
+                           host, port, e)
             return error_msg
 
         # Get the replica id from supplier to compare to the consumer's rid
@@ -3407,5 +3408,5 @@ class DirSrv(SimpleLDAPObject, object):
         ents = self.search_s(basedn, scope, filterstr)
 
         for ent in sorted(ents, key=lambda e: len(e.dn), reverse=True):
-            self.log.debug("Delete entry children %s" % (ent.dn))
+            self.log.debug("Delete entry children %s", ent.dn)
             self.delete_ext_s(ent.dn, serverctrls=serverctrls, clientctrls=clientctrls)
diff --git a/src/lib389/lib389/agreement.py b/src/lib389/lib389/agreement.py
index d7ca0a2..9e8d90f 100644
--- a/src/lib389/lib389/agreement.py
+++ b/src/lib389/lib389/agreement.py
@@ -336,7 +336,7 @@ class AgreementLegacy(object):
             raise
 
         # update it
-        self.log.info("Schedule replication agreement %s" % agmtdn)
+        self.log.info("Schedule replication agreement %s", agmtdn)
         mod = [(ldap.MOD_REPLACE, 'nsds5replicaupdateschedule', [ensure_bytes(interval)])]
         self.conn.modify_s(agmtdn, mod)
 
@@ -436,12 +436,12 @@ class AgreementLegacy(object):
             if not inProperties(prop, RA_PROPNAME_TO_ATTRNAME):
                 raise ValueError("unknown property: %s" % prop)
             else:
-                self.log.debug("setProperties: %s:%s" %
-                               (prop, properties[prop]))
+                self.log.debug("setProperties: %s:%s",
+                               prop, properties[prop])
 
         # At least we need to have suffix/agmnt_dn/agmnt_entry
         if not suffix and not agmnt_dn and not agmnt_entry:
-            raise InvalidArgumentError("suffix and agmnt_dn and agmnt_entry " +
+            raise InvalidArgumentError("suffix and agmnt_dn and agmnt_entry "
                                        "are missing")
 
         # TODO
@@ -634,7 +634,7 @@ class AgreementLegacy(object):
         # we can just raise ALREADY_EXISTS
         try:
             entry = self.conn.getEntry(dn_agreement, ldap.SCOPE_BASE)
-            self.log.warn("Agreement already exists: %r" % dn_agreement)
+            self.log.warn("Agreement already exists: %r", dn_agreement)
             return dn_agreement
         except ldap.NO_SUCH_OBJECT:
             entry = None
@@ -657,10 +657,10 @@ class AgreementLegacy(object):
             self.conn.setupWinSyncAgmt(propertiescopy, entry)
 
         try:
-            self.log.debug("Adding replica agreement: [%r]" % entry)
+            self.log.debug("Adding replica agreement: [%r]", entry)
             self.conn.add_s(entry)
         except ldap.LDAPError as e:
-            self.log.fatal('Failed to add replication agreement: %s' % str(e))
+            self.log.fatal('Failed to add replication agreement: %s', e)
             raise e
 
         entry = self.conn.waitForEntry(dn_agreement)
@@ -728,10 +728,10 @@ class AgreementLegacy(object):
                 try:
                     agmt_dn = agmts[0].dn
                     self.conn.delete_s(agmt_dn)
-                    self.log.info('Agreement (%s) was successfully removed' % agmt_dn)
+                    self.log.info('Agreement (%s) was successfully removed', agmt_dn)
                 except ldap.LDAPError as e:
-                    self.log.error('Failed to delete agreement (%s), ' +
-                                   'error: %s' % (agmt_dn, str(e)))
+                    self.log.error('Failed to delete agreement (%s), '
+                                   'error: %s', agmt_dn, e)
                     raise
         else:
             raise NoSuchEntryError('No agreements were found')
@@ -777,8 +777,8 @@ class AgreementLegacy(object):
             raise NoSuchEntryError(
                 "Error: no replica set up for suffix " + suffix)
         replica_entry = replica_entries[0]
-        self.log.debug("initAgreement: looking for replica agreements " +
-                       "under %s" % replica_entry.dn)
+        self.log.debug("initAgreement: looking for replica agreements "
+                       "under %s", replica_entry.dn)
         try:
             '''
             Currently python does not like long continuous lines when it
@@ -802,7 +802,7 @@ class AgreementLegacy(object):
         #
         # trigger the total init
         #
-        self.log.info("Starting total init %s" % entry.dn)
+        self.log.info("Starting total init %s", entry.dn)
         mod = [(ldap.MOD_ADD, 'nsds5BeginReplicaRefresh', ensure_bytes('start'))]
         self.conn.modify_s(entry.dn, mod)
 
@@ -827,7 +827,7 @@ class AgreementLegacy(object):
         :raises: ValueError - if interval is not valid
         """
 
-        self.log.info("Pausing replication %s" % agmtdn)
+        self.log.info("Pausing replication %s", agmtdn)
         mod = [(ldap.MOD_REPLACE, 'nsds5ReplicaEnabled', [b'off'])]
         self.conn.modify_s(ensure_str(agmtdn), mod)
 
@@ -853,7 +853,7 @@ class AgreementLegacy(object):
                   - ldap.NO_SUCH_OBJECT - if agmtdn does not exist
         """
 
-        self.log.info("Resuming replication %s" % agmtdn)
+        self.log.info("Resuming replication %s", agmtdn)
         mod = [(ldap.MOD_REPLACE, 'nsds5ReplicaEnabled', [b'on'])]
         self.conn.modify_s(ensure_str(agmtdn), mod)
 
diff --git a/src/lib389/lib389/backend.py b/src/lib389/lib389/backend.py
index 3fcaf07..80fa403 100644
--- a/src/lib389/lib389/backend.py
+++ b/src/lib389/lib389/backend.py
@@ -64,11 +64,11 @@ class BackendLegacy(object):
 
         filt = "(objectclass=%s)" % BACKEND_OBJECTCLASS_VALUE
         if backend_dn:
-            self.log.info("List backend %s" % backend_dn)
+            self.log.info("List backend %s", backend_dn)
             base = backend_dn
             scope = ldap.SCOPE_BASE
         elif suffix:
-            self.log.info("List backend with suffix=%s" % suffix)
+            self.log.info("List backend with suffix=%s", suffix)
             base = DN_PLUGIN
             scope = ldap.SCOPE_SUBTREE
             filt = ("(&%s(|(%s=%s)(%s=%s)))" %
@@ -78,7 +78,7 @@ class BackendLegacy(object):
                      normalizeDN(suffix))
                     )
         elif bename:
-            self.log.info("List backend 'cn=%s'" % bename)
+            self.log.info("List backend 'cn=%s'", bename)
             base = "%s=%s,%s" % (BACKEND_PROPNAME_TO_ATTRNAME[BACKEND_NAME],
                                  bename, DN_LDBM)
             scope = ldap.SCOPE_BASE
@@ -155,7 +155,7 @@ class BackendLegacy(object):
                 (suffix, backend_dn, bename))
         elif len(be_ents) > 1:
             for ent in be_ents:
-                self.log.fatal("Multiple backend match the definition: %s" %
+                self.log.fatal("Multiple backend match the definition: %s",
                                ent.dn)
             if (not suffix) and (not backend_dn) and (not bename):
                 raise ldap.UNWILLING_TO_PERFORM(
@@ -193,10 +193,10 @@ class BackendLegacy(object):
         # finally delete the backend children and the backend itself
         ents = self.conn.search_s(be_ent.dn, ldap.SCOPE_ONELEVEL)
         for ent in ents:
-            self.log.debug("Delete entry children %s" % (ent.dn))
+            self.log.debug("Delete entry children %s", ent.dn)
             self.conn.delete_s(ent.dn)
 
-        self.log.debug("Delete backend entry %s" % (be_ent.dn))
+        self.log.debug("Delete backend entry %s", be_ent.dn)
         self.conn.delete_s(be_ent.dn)
 
         return
@@ -246,12 +246,12 @@ class BackendLegacy(object):
                         (BACKEND_PROPNAME_TO_ATTRNAME[BACKEND_NAME],
                          bename, parent))
                 filt = "(objectclass=%s)" % BACKEND_OBJECTCLASS_VALUE
-                self.log.debug("_getBackendName: baser=%s : fileter=%s" %
-                               (base, filt))
+                self.log.debug("_getBackendName: baser=%s : fileter=%s",
+                               base, filt)
                 try:
                     self.conn.getEntry(base, ldap.SCOPE_BASE, filt)
                 except (NoSuchEntryError, ldap.NO_SUCH_OBJECT):
-                    self.log.info("backend name will be %s" % bename)
+                    self.log.info("backend name will be %s", bename)
                     return bename
                 index += 1
 
@@ -265,7 +265,7 @@ class BackendLegacy(object):
 
         # Check it does not already exist a backend for that suffix
         if self.conn.verbose:
-            self.log.info("Checking suffix %s for existence" % suffix)
+            self.log.info("Checking suffix %s for existence", suffix)
         ents = self.conn.backend.list(suffix=suffix)
         if len(ents) != 0:
             raise ldap.ALREADY_EXISTS
@@ -317,13 +317,13 @@ class BackendLegacy(object):
                      properties[BACKEND_CHAIN_BIND_PW]
                      })
 
-            self.log.debug("adding entry: %r" % entry)
+            self.log.debug("adding entry: %r", entry)
             self.conn.add_s(entry)
         except ldap.ALREADY_EXISTS as e:
-            self.log.error("Entry already exists: %r" % dn)
+            self.log.error("Entry already exists: %r", dn)
             raise ldap.ALREADY_EXISTS("%s : %r" % (e, dn))
         except ldap.LDAPError as e:
-            self.log.error("Could not add backend entry: %r" % dn)
+            self.log.error("Could not add backend entry: %r", dn)
             raise e
 
         backend_entry = self.conn._test_entry(dn, ldap.SCOPE_BASE)
@@ -365,7 +365,7 @@ class BackendLegacy(object):
 
             attrs = [attr_suffix]
             ent = self.conn.getEntry(name, ldap.SCOPE_BASE, filt, attrs)
-            self.log.debug("toSuffix: %s found by its DN" % ent.dn)
+            self.log.debug("toSuffix: %s found by its DN", ent.dn)
 
             if not ent.hasValue(attr_suffix):
                 raise ValueError("Entry has no %s attribute %r" %
diff --git a/src/lib389/lib389/changelog.py b/src/lib389/lib389/changelog.py
index bed42a0..d973a57 100644
--- a/src/lib389/lib389/changelog.py
+++ b/src/lib389/lib389/changelog.py
@@ -122,12 +122,12 @@ class ChangelogLegacy(object):
             CHANGELOG_PROPNAME_TO_ATTRNAME[CHANGELOG_NAME]: changelog_name,
             CHANGELOG_PROPNAME_TO_ATTRNAME[CHANGELOG_DIR]: dirpath
         })
-        self.log.debug("adding changelog entry: %r" % entry)
+        self.log.debug("adding changelog entry: %r", entry)
         self.conn.changelogdir = dirpath
         try:
             self.conn.add_s(entry)
         except ldap.ALREADY_EXISTS:
-            self.log.warn("entry %s already exists" % dn)
+            self.log.warn("entry %s already exists", dn)
         return dn
 
     def delete(self):
@@ -139,7 +139,7 @@ class ChangelogLegacy(object):
         try:
             self.conn.delete_s(DN_CHANGELOG)
         except ldap.LDAPError as e:
-            self.log.error('Failed to delete the changelog: ' + str(e))
+            self.log.error('Failed to delete the changelog: %s', e)
             raise
 
     def setProperties(self, changelogdn=None, properties=None):
diff --git a/src/lib389/lib389/dirsrv_log.py b/src/lib389/lib389/dirsrv_log.py
index 6d1e070..1a626c2 100644
--- a/src/lib389/lib389/dirsrv_log.py
+++ b/src/lib389/lib389/dirsrv_log.py
@@ -208,7 +208,7 @@ class DirsrvAccessLog(DirsrvLog):
         }
         # First, pull some well known info out.
         if self.dirsrv.verbose:
-            self.log.info("--> %s " % line)
+            self.log.info("--> %s ", line)
 
         for regex in self.full_regexs:
             result = regex.match(line)
diff --git a/src/lib389/lib389/index.py b/src/lib389/lib389/index.py
index 54c7590..48e72a3 100644
--- a/src/lib389/lib389/index.py
+++ b/src/lib389/lib389/index.py
@@ -76,7 +76,7 @@ class IndexLegacy(object):
         self.conn.delete_branch_s(dn, ldap.SCOPE_ONELEVEL)
 
         # Then delete the top index entry
-        self.log.debug("Delete head index entry %s" % (dn))
+        self.log.debug("Delete head index entry %s", dn)
         self.conn.delete_s(dn)
 
     def create(self, suffix=None, be_name=None, attr=None, args=None):
diff --git a/src/lib389/lib389/instance/options.py b/src/lib389/lib389/instance/options.py
index edbf930..c41586c 100644
--- a/src/lib389/lib389/instance/options.py
+++ b/src/lib389/lib389/instance/options.py
@@ -74,7 +74,7 @@ class Options2(object):
                 err_msg = ('Invalid value in section "%s", "%s" has incorrect type (%s)' % (self._section, k, str(e)))
                 raise ValueError(err_msg)
             except configparser.NoOptionError:
-                self.log.debug('%s:%s not in inf, using default' % (self._section, k))
+                self.log.debug('%s:%s not in inf, using default', self._section, k)
                 continue
             self._options[k] = v
 
diff --git a/src/lib389/lib389/instance/setup.py b/src/lib389/lib389/instance/setup.py
index c55d509..04cad30 100644
--- a/src/lib389/lib389/instance/setup.py
+++ b/src/lib389/lib389/instance/setup.py
@@ -117,7 +117,7 @@ class SetupDs(object):
         except ValueError:
             return value
         except configparser.NoOptionError:
-            self.log.info("%s not specified:setting to default - %s" % (attr, value))
+            self.log.info("%s not specified:setting to default - %s", attr, value)
             return value
 
     def _validate_config_2(self, config):
@@ -139,7 +139,7 @@ class SetupDs(object):
         general = general_options.collect()
 
         if self.verbose:
-            self.log.info("Configuration general %s" % general)
+            self.log.info("Configuration general %s", general)
 
         slapd_options = Slapd2Base(self.log)
         slapd_options.parse_inf_config(config)
@@ -147,7 +147,7 @@ class SetupDs(object):
         slapd = slapd_options.collect()
 
         if self.verbose:
-            self.log.info("Configuration slapd %s" % slapd)
+            self.log.info("Configuration slapd %s", slapd)
 
         backends = []
         for section in config.sections():
@@ -183,7 +183,7 @@ class SetupDs(object):
                     backends.append(be)
 
         if self.verbose:
-            self.log.info("Configuration backends %s" % backends)
+            self.log.info("Configuration backends %s", backends)
 
         return (general, slapd, backends)
 
@@ -477,20 +477,20 @@ class SetupDs(object):
         """
         # Get the inf file
         if self.verbose:
-            self.log.info("Using inf from %s" % inf_path)
+            self.log.info("Using inf from %s", inf_path)
         if not os.path.isfile(inf_path):
-            self.log.error("%s is not a valid file path" % inf_path)
+            self.log.error("%s is not a valid file path", inf_path)
             return False
         config = None
         try:
             config = configparser.SafeConfigParser()
             config.read([inf_path])
         except Exception as e:
-            self.log.error("Exception %s occured" % e)
+            self.log.error("Exception %s occured", e)
             return False
 
         if self.verbose:
-            self.log.info("Configuration %s" % config.sections())
+            self.log.info("Configuration %s", config.sections())
 
         (general, slapd, backends) = self._validate_ds_config(config)
 
@@ -503,7 +503,7 @@ class SetupDs(object):
 
         assert_c(general['defaults'] is not None, "Configuration defaults in section [general] not found")
         if self.verbose:
-            self.log.info("PASSED: using config settings %s" % general['defaults'])
+            self.log.info("PASSED: using config settings %s", general['defaults'])
         # Validate our arguments.
         assert_c(slapd['user'] is not None, "Configuration user in section [slapd] not found")
         # check the user exists
@@ -572,7 +572,7 @@ class SetupDs(object):
         self._secure_password = password_hash(self._raw_secure_password, bin_dir=slapd['bin_dir'])
 
         if self.verbose:
-            self.log.info("INFO: temp root password set to %s" % self._raw_secure_password)
+            self.log.info("INFO: temp root password set to %s", self._raw_secure_password)
             self.log.info("PASSED: root user checking")
 
         assert_c(slapd['port'] is not None, "Configuration port in section [slapd] not found")
@@ -596,14 +596,14 @@ class SetupDs(object):
 
         # Check we have privs to run
         if self.verbose:
-            self.log.info("READY: Preparing installation for %s..." % slapd['instance_name'])
+            self.log.info("READY: Preparing installation for %s...", slapd['instance_name'])
 
         self._prepare_ds(general, slapd, backends)
         # Call our child api to prepare itself.
         self._prepare(extra)
 
         if self.verbose:
-            self.log.info("READY: Beginning installation for %s..." % slapd['instance_name'])
+            self.log.info("READY: Beginning installation for %s...", slapd['instance_name'])
 
         if self.dryrun:
             self.log.info("NOOP: Dry run requested")
@@ -613,9 +613,9 @@ class SetupDs(object):
             # Call the child api to do anything it needs.
             self._install(extra)
         if self.verbose:
-            self.log.info("FINISH: Completed installation for %s" % slapd['instance_name'])
+            self.log.info("FINISH: Completed installation for %s", slapd['instance_name'])
         else:
-            self.log.info("Completed installation for %s" % slapd['instance_name'])
+            self.log.info("Completed installation for %s", slapd['instance_name'])
 
     def _install_ds(self, general, slapd, backends):
         """
@@ -649,7 +649,7 @@ class SetupDs(object):
         # we should only need to make bak_dir, cert_dir, config_dir, db_dir, ldif_dir, lock_dir, log_dir, run_dir? schema_dir,
         for path in ('backup_dir', 'cert_dir', 'config_dir', 'db_dir', 'ldif_dir', 'lock_dir', 'log_dir', 'run_dir'):
             if self.verbose:
-                self.log.info("ACTION: creating %s" % slapd[path])
+                self.log.info("ACTION: creating %s", slapd[path])
             try:
                 os.makedirs(slapd[path], mode=0o775)
             except OSError:
@@ -692,7 +692,7 @@ class SetupDs(object):
 
         # Create certdb in sysconfidir
         if self.verbose:
-            self.log.info("ACTION: Creating certificate database is %s" % slapd['cert_dir'])
+            self.log.info("ACTION: Creating certificate database is %s", slapd['cert_dir'])
 
         # Create dse.ldif with a temporary root password.
         # The template is in slapd['data_dir']/dirsrv/data/template-dse.ldif
diff --git a/src/lib389/lib389/mappingTree.py b/src/lib389/lib389/mappingTree.py
index a567d3d..7a59020 100644
--- a/src/lib389/lib389/mappingTree.py
+++ b/src/lib389/lib389/mappingTree.py
@@ -69,7 +69,7 @@ class MappingTreeLegacy(object):
             ents = self.conn.search_s(DN_MAPPING_TREE, ldap.SCOPE_ONELEVEL,
                                       filt)
             for ent in ents:
-                self.log.debug('list: %r' % ent)
+                self.log.debug('list: %r', ent)
         except:
             raise
 
@@ -151,8 +151,8 @@ class MappingTreeLegacy(object):
             entry.setValues(MT_PROPNAME_TO_ATTRNAME[MT_PARENT_SUFFIX], nparent)
 
         try:
-            self.log.debug("Creating entry: %s" % entry.dn)
-            self.log.info("Entry %r" % entry)
+            self.log.debug("Creating entry: %s", entry.dn)
+            self.log.info("Entry %r", entry)
             self.conn.add_s(entry)
         except ldap.LDAPError as e:
             raise ldap.LDAPError("Error adding suffix entry " + dn, e)
@@ -187,7 +187,7 @@ class MappingTreeLegacy(object):
             filt = "(objectclass=%s)" % MT_OBJECTCLASS_VALUE
             try:
                 ent = self.conn.getEntry(name, ldap.SCOPE_BASE, filt)
-                self.log.debug("delete: %s found by its DN" % ent.dn)
+                self.log.debug("delete: %s found by its DN", ent.dn)
             except NoSuchEntryError:
                 raise ldap.NO_SUCH_OBJECT("mapping tree DN not found: %s" %
                                           name)
@@ -210,7 +210,7 @@ class MappingTreeLegacy(object):
             try:
                 ent = self.conn.getEntry(DN_MAPPING_TREE, ldap.SCOPE_ONELEVEL,
                                          filt)
-                self.log.debug("delete: %s found by with %s" % (ent.dn, filt))
+                self.log.debug("delete: %s found by with %s", ent.dn, filt)
             except NoSuchEntryError:
                 raise ldap.NO_SUCH_OBJECT("mapping tree DN not found: %s" %
                                           name)
@@ -227,13 +227,13 @@ class MappingTreeLegacy(object):
             raise
         if len(ents) != 1:
             for entry in ents:
-                self.log.warning("Error: it exists %s under %s" %
-                                 (entry.dn, ent.dn))
+                self.log.warning("Error: it exists %s under %s",
+                                 entry.dn, ent.dn)
             raise ldap.UNWILLING_TO_PERFORM(
                 "Unable to delete %s, it is not a leaf" % ent.dn)
         else:
             for entry in ents:
-                self.log.warning("Warning: %s (%s)" % (entry.dn, ent.dn))
+                self.log.warning("Warning: %s (%s)", entry.dn, ent.dn)
             self.conn.delete_s(ent.dn)
 
     def getProperties(self, suffix=None, bename=None, name=None,
@@ -272,7 +272,7 @@ class MappingTreeLegacy(object):
                 ent = self.conn.getEntry(name, ldap.SCOPE_BASE, filt,
                                          list(MT_PROPNAME_TO_ATTRNAME.values())
                                          )
-                self.log.debug("delete: %s found by its DN" % ent.dn)
+                self.log.debug("delete: %s found by its DN", ent.dn)
             except NoSuchEntryError:
                 raise ldap.NO_SUCH_OBJECT("mapping tree DN not found: %s" %
                                           name)
@@ -296,7 +296,7 @@ class MappingTreeLegacy(object):
                                          filt,
                                          list(MT_PROPNAME_TO_ATTRNAME.values())
                                          )
-                self.log.debug("delete: %s found by with %s" % (ent.dn, filt))
+                self.log.debug("delete: %s found by with %s", ent.dn, filt)
             except NoSuchEntryError:
                 raise ldap.NO_SUCH_OBJECT("mapping tree DN not found: %s" %
                                           name)
@@ -311,8 +311,8 @@ class MappingTreeLegacy(object):
                 prop_attr = MT_PROPNAME_TO_ATTRNAME[prop_name]
                 if not prop_attr:
                     raise ValueError("Improper property name: %s ", prop_name)
-                self.log.debug("Look for attr %s (property: %s)" %
-                               (prop_attr, prop_name))
+                self.log.debug("Look for attr %s (property: %s)",
+                               prop_attr, prop_name)
                 attrs.append(prop_attr)
 
         # now look for each attribute from the MT entry
@@ -327,7 +327,7 @@ class MappingTreeLegacy(object):
                 if len(attrs) > 0:
                     if MT_PROPNAME_TO_ATTRNAME[props[0]] in attrs:
                         # if the properties was requested
-                        self.log.debug("keep only attribute %s " % (props[0]))
+                        self.log.debug("keep only attribute %s ", props[0])
                         result[props[0]] = ent.getValues(attr)
                 else:
                     result[props[0]] = ent.getValues(attr)
@@ -365,7 +365,7 @@ class MappingTreeLegacy(object):
             try:
                 attrs = [attr_suffix]
                 ent = self.conn.getEntry(name, ldap.SCOPE_BASE, filt, attrs)
-                self.log.debug("toSuffix: %s found by its DN" % ent.dn)
+                self.log.debug("toSuffix: %s found by its DN", ent.dn)
             except NoSuchEntryError:
                 raise ldap.NO_SUCH_OBJECT("mapping tree DN not found: %s" %
                                           name)
diff --git a/src/lib389/lib389/nss_ssl.py b/src/lib389/lib389/nss_ssl.py
index bd1f81c..0c71e9c 100644
--- a/src/lib389/lib389/nss_ssl.py
+++ b/src/lib389/lib389/nss_ssl.py
@@ -133,9 +133,9 @@ class NssSsl(object):
         # 48886; This needs to be sql format ...
         cmd = ['/usr/bin/certutil', '-N', '-d', self._certdb, '-f', '%s/%s' % (self._certdb, PWD_TXT)]
         self._generate_noise('%s/noise.txt' % self._certdb)
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
-        self.log.debug("nss output: %s" % result)
+        self.log.debug("nss output: %s", result)
         return True
 
     def _db_exists(self):
@@ -198,9 +198,9 @@ class NssSsl(object):
             '-f',
             '%s/%s' % (self._certdb, PWD_TXT),
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
-        self.log.debug("nss output: %s" % result)
+        self.log.debug("nss output: %s", result)
         # Now extract the CAcert to a well know place.
         # This allows us to point the cacert dir here and it "just works"
         cmd = [
@@ -212,12 +212,12 @@ class NssSsl(object):
             self._certdb,
             '-a',
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         certdetails = check_output(cmd, stderr=subprocess.STDOUT)
         with open('%s/ca.crt' % self._certdb, 'w') as f:
             f.write(ensure_str(certdetails))
         cmd = ['/usr/bin/c_rehash', self._certdb]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
         return True
 
@@ -234,7 +234,7 @@ class NssSsl(object):
             '-d',
             self._certdb,
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         certdetails = check_output(cmd, stderr=subprocess.STDOUT, encoding='utf-8')
         end_date_str = certdetails.split("Not After : ")[1].split("\n")[0]
         date_format = '%a %b %d %H:%M:%S %Y'
@@ -273,7 +273,7 @@ class NssSsl(object):
             '-a',
             '-o', csr_path,
             ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
 
         # Sign the CSR with our old CA
@@ -295,11 +295,11 @@ class NssSsl(object):
             '-v',
             '%s' % months,
             ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
 
         cmd = ['/usr/bin/c_rehash', self._certdb]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
 
         # Import the new CA to our DB instead of the old CA
@@ -313,7 +313,7 @@ class NssSsl(object):
             '-d', self._certdb,
             '-f', '%s/%s' % (self._certdb, PWD_TXT),
             ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
 
         return crt_path
@@ -330,11 +330,11 @@ class NssSsl(object):
         result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
 
         # We can skip the first few lines. They are junk
-        # IE ['', 
-        #     'Certificate Nickname                                         Trust Attributes', 
-        #     '                                                             SSL,S/MIME,JAR/XPI', 
-        #     '', 
-        #     'Self-Signed-CA                                               CTu,u,u', 
+        # IE ['',
+        #     'Certificate Nickname                                         Trust Attributes',
+        #     '                                                             SSL,S/MIME,JAR/XPI',
+        #     '',
+        #     'Self-Signed-CA                                               CTu,u,u',
         #     '']
         lines = result.split('\n')[4:-1]
         # Now make the lines usable
@@ -354,7 +354,7 @@ class NssSsl(object):
             '-f',
             '%s/%s' % (self._certdb, PWD_TXT),
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
 
         lines = result.split('\n')[1:-1]
@@ -456,9 +456,9 @@ class NssSsl(object):
             '-f',
             '%s/%s' % (self._certdb, PWD_TXT),
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
-        self.log.debug("nss output: %s" % result)
+        self.log.debug("nss output: %s", result)
         return True
 
     def create_rsa_key_and_csr(self, alt_names=[]):
@@ -501,7 +501,7 @@ class NssSsl(object):
             '-a',
             '-o', csr_path,
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
 
         return csr_path
@@ -527,7 +527,7 @@ class NssSsl(object):
             '-o', crt_path,
             '-c', CA_NAME,
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
 
         return (ca_path, crt_path)
@@ -544,7 +544,7 @@ class NssSsl(object):
         if ca is not None:
             shutil.copyfile(ca, '%s/ca.crt' % self._certdb)
             cmd = ['/usr/bin/c_rehash', self._certdb]
-            self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+            self.log.debug("nss cmd: %s", format_cmd_list(cmd))
             check_output(cmd, stderr=subprocess.STDOUT)
             cmd = [
                 '/usr/bin/certutil',
@@ -557,7 +557,7 @@ class NssSsl(object):
                 '-f',
                 '%s/%s' % (self._certdb, PWD_TXT),
             ]
-            self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+            self.log.debug("nss cmd: %s", format_cmd_list(cmd))
             check_output(cmd, stderr=subprocess.STDOUT)
 
         if crt is not None:
@@ -572,7 +572,7 @@ class NssSsl(object):
                 '-f',
                 '%s/%s' % (self._certdb, PWD_TXT),
             ]
-            self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+            self.log.debug("nss cmd: %s", format_cmd_list(cmd))
             check_output(cmd, stderr=subprocess.STDOUT)
             cmd = [
                 '/usr/bin/certutil',
@@ -581,7 +581,7 @@ class NssSsl(object):
                 '-n', CERT_NAME,
                 '-u', 'YCV'
             ]
-            self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+            self.log.debug("nss cmd: %s", format_cmd_list(cmd))
             check_output(cmd, stderr=subprocess.STDOUT)
 
     def create_rsa_user(self, name, months=VALID):
@@ -624,10 +624,10 @@ class NssSsl(object):
             '-f',
             '%s/%s' % (self._certdb, PWD_TXT),
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
 
         result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
-        self.log.debug("nss output: %s" % result)
+        self.log.debug("nss output: %s", result)
         # Now extract this into PEM files that we can use.
         # pk12util -o user-william.p12 -d . -k pwdfile.txt -n user-william -W ''
         cmd = [
@@ -638,7 +638,7 @@ class NssSsl(object):
             '-n', '%s%s' % (USER_PREFIX, name),
             '-W', '""'
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
         # openssl pkcs12 -in user-william.p12 -passin pass:'' -out file.pem -nocerts -nodes
         # Extract the key
@@ -651,7 +651,7 @@ class NssSsl(object):
             '-nocerts',
             '-nodes'
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
         # Extract the cert
         cmd = [
@@ -664,7 +664,7 @@ class NssSsl(object):
             '-clcerts',
             '-nodes'
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
         # Convert the cert for userCertificate attr
         cmd = [
@@ -675,7 +675,7 @@ class NssSsl(object):
             '-in', '%s/%s%s.crt' % (self._certdb, USER_PREFIX, name),
             '-out', '%s/%s%s.der' % (self._certdb, USER_PREFIX, name),
         ]
-        self.log.debug("nss cmd: %s" % format_cmd_list(cmd))
+        self.log.debug("nss cmd: %s", format_cmd_list(cmd))
         check_output(cmd, stderr=subprocess.STDOUT)
 
         return subject
diff --git a/src/lib389/lib389/replica.py b/src/lib389/lib389/replica.py
index 5b28b01..bf09c3d 100644
--- a/src/lib389/lib389/replica.py
+++ b/src/lib389/lib389/replica.py
@@ -113,10 +113,10 @@ class ReplicaLegacy(object):
                 raise KeyError
         except KeyError:
             if not repl_manager_pw:
-                self.log.warning("replica_createReplMgr: bind DN password " +
+                self.log.warning("replica_createReplMgr: bind DN password "
                                  "not specified")
             if not repl_manager_dn:
-                self.log.warning("replica_createReplMgr: bind DN not " +
+                self.log.warning("replica_createReplMgr: bind DN not "
                                  "specified")
             raise
 
@@ -136,7 +136,7 @@ class ReplicaLegacy(object):
                      'passwordExpirationTime': '20381010000000Z'}
             self.conn.setupBindDN(repl_manager_dn, repl_manager_pw, attrs)
         except ldap.ALREADY_EXISTS:
-            self.log.warn("User already exists (weird we just checked: %s " %
+            self.log.warn("User already exists (weird we just checked: %s ",
                           repl_manager_dn)
 
     def list(self, suffix=None, replica_dn=None):
@@ -215,8 +215,8 @@ class ReplicaLegacy(object):
             if not inProperties(prop, REPLICA_PROPNAME_TO_ATTRNAME):
                 raise ValueError("unknown property: %s" % prop)
             else:
-                self.log.debug("setProperties: %s:%s" %
-                               (prop, properties[prop]))
+                self.log.debug("setProperties: %s:%s",
+                               prop, properties[prop])
 
         # At least we need to have suffix/replica_dn/replica_entry
         if not suffix and not replica_dn and not replica_entry:
@@ -334,12 +334,12 @@ class ReplicaLegacy(object):
             raise InvalidArgumentError("role missing")
 
         if not ReplicaLegacy._valid_role(role):
-            self.log.fatal("enableReplication: replica role invalid (%s) " % role)
+            self.log.fatal("enableReplication: replica role invalid (%s) ", role)
             raise ValueError("invalid role: %s" % role)
 
         # check the validity of 'rid'
         if not ReplicaLegacy._valid_rid(role, rid=rid):
-            self.log.fatal("Replica.create: replica role is master but 'rid'" +
+            self.log.fatal("Replica.create: replica role is master but 'rid'"
                            " is missing or invalid value")
             raise InvalidArgumentError("rid missing or invalid value")
 
@@ -390,7 +390,7 @@ class ReplicaLegacy(object):
         dn_replica = ','.join((RDN_REPLICA, mtent.dn))
         try:
             entry = self.conn.getEntry(dn_replica, ldap.SCOPE_BASE)
-            self.log.warn("Already setup replica for suffix %r" % nsuffix)
+            self.log.warn("Already setup replica for suffix %r", nsuffix)
             self.conn.suffixes.setdefault(nsuffix, {})
             self.conn.replica.setProperties(replica_dn=dn_replica,
                                             properties=properties)
@@ -434,13 +434,13 @@ class ReplicaLegacy(object):
                 try:
                     self.conn.delete_s(agmt.dn)
                 except ldap.LDAPError as e:
-                    self.log.fatal('Failed to delete replica agreement (%s),' +
-                                   ' error: %s' %
-                                   (agmt.dn, str(e)))
+                    self.log.fatal('Failed to delete replica agreement (%s),'
+                                   ' error: %s',
+                                   agmt.dn, e)
                     raise
         except ldap.LDAPError as e:
-            self.log.fatal('Failed to search for replication agreements ' +
-                           'under (%s), error: %s' % (dn_replica, str(e)))
+            self.log.fatal('Failed to search for replication agreements '
+                           'under (%s), error: %s', dn_replica, e)
             raise
 
     def disableReplication(self, suffix=None):
@@ -481,8 +481,8 @@ class ReplicaLegacy(object):
         try:
             self.conn.delete_s(dn_replica)
         except ldap.LDAPError as e:
-            self.log.fatal('Failed to delete replica configuration ' +
-                           '(%s), error: %s' % (dn_replica, str(e)))
+            self.log.fatal('Failed to delete replica configuration '
+                           '(%s), error: %s', dn_replica, e)
             raise
 
     def enableReplication(self, suffix=None, role=None,
@@ -493,7 +493,7 @@ class ReplicaLegacy(object):
             raise ValueError("suffix missing")
 
         if not role:
-            self.log.fatal("enableReplication: replica role not specify " +
+            self.log.fatal("enableReplication: replica role not specify "
                            "(ReplicaRole.*)")
             raise ValueError("role missing")
 
@@ -502,10 +502,11 @@ class ReplicaLegacy(object):
         #
 
         # First role and replicaID
-        if role != ReplicaRole.MASTER and \
-           role != ReplicaRole.HUB and \
-           role != ReplicaRole.CONSUMER:
-            self.log.fatal("enableReplication: replica role invalid (%s) " %
+        if (role != ReplicaRole.MASTER and
+            role != ReplicaRole.HUB and
+            role != ReplicaRole.CONSUMER
+        ):
+            self.log.fatal("enableReplication: replica role invalid (%s) ",
                            role)
             raise ValueError("invalid role: %s" % role)
 
@@ -515,29 +516,29 @@ class ReplicaLegacy(object):
                (replicaId <= 0) or \
                (replicaId >= CONSUMER_REPLICAID):
                 self.log.fatal("enableReplication: invalid replicaId (%s) "
-                               "for a RW replica" % replicaId)
+                               "for a RW replica", replicaId)
                 raise ValueError("invalid replicaId %d (expected [1.."
                                  "CONSUMER_REPLICAID]" % replicaId)
         elif replicaId != CONSUMER_REPLICAID:
             # check the replicaId is CONSUMER_REPLICAID
             self.log.fatal("enableReplication: invalid replicaId (%s) for a "
-                           "Read replica (expected %d)" %
-                           (replicaId, CONSUMER_REPLICAID))
+                           "Read replica (expected %d)",
+                           replicaId, CONSUMER_REPLICAID)
             raise ValueError("invalid replicaId: %d for HUB/CONSUMER "
                              "replicaId is CONSUMER_REPLICAID" % replicaId)
 
         # Now check we have a suffix
         entries_backend = self.conn.backend.list(suffix=suffix)
         if not entries_backend:
-            self.log.fatal("enableReplication: unable to retrieve the " +
-                           "backend for %s" % suffix)
+            self.log.fatal("enableReplication: unable to retrieve the "
+                           "backend for %s", suffix)
             raise ValueError("no backend for suffix %s" % suffix)
 
         ent = entries_backend[0]
         if normalizeDN(suffix) != normalizeDN(ent.getValue('nsslapd-suffix')):
             self.log.warning("enableReplication: suffix (%s) and backend "
-                             "suffix (%s) differs" %
-                             (suffix, entries_backend[0].nsslapd - suffix))
+                             "suffix (%s) differs",
+                             suffix, entries_backend[0].nsslapd - suffix)
             pass
 
         # Now prepare the bindDN property
@@ -551,7 +552,7 @@ class ReplicaLegacy(object):
                 # weird, internal error we do not retrieve the default
                 # replication bind DN this replica will not be updatable
                 # through replication until the binddn property will be set
-                self.log.warning("enableReplication: binddn not provided and" +
+                self.log.warning("enableReplication: binddn not provided and"
                                  " default value unavailable")
                 pass
 
@@ -586,7 +587,7 @@ class ReplicaLegacy(object):
             entry = self.conn.getEntry(
                 agmtdn, ldap.SCOPE_BASE, "(objectclass=*)", attrlist)
         except NoSuchEntryError:
-            self.log.exception("Error reading status from agreement %r" %
+            self.log.exception("Error reading status from agreement %r",
                                agmtdn)
             hasError = 1
         else:
@@ -639,7 +640,7 @@ class ReplicaLegacy(object):
         """Initialize replication without waiting.
             @param agmtdn - agreement dn
         """
-        self.log.info("Starting async replication %s" % agmtdn)
+        self.log.info("Starting async replication %s", agmtdn)
         mod = [(ldap.MOD_ADD, 'nsds5BeginReplicaRefresh', b'start')]
         self.conn.modify_s(agmtdn, mod)
 
@@ -666,8 +667,8 @@ class ReplicaLegacy(object):
         if ents and (len(ents) > 0):
             ent = ents[0]
         elif tryrepl:
-            self.log.warn("Could not get RUV from %r entry -" +
-                          " trying cn=replica" % suffix)
+            self.log.warn("Could not get RUV from %r entry -"
+                          " trying cn=replica", suffix)
             ensuffix = escapeDNValue(normalizeDN(suffix))
             dn = ','.join(("cn=replica", "cn=%s" % ensuffix, DN_MAPPING_TREE))
             ents = self.conn.search_s(dn, ldap.SCOPE_BASE, "objectclass=*",
@@ -675,7 +676,7 @@ class ReplicaLegacy(object):
 
         if ents and (len(ents) > 0):
             ent = ents[0]
-            self.log.debug("RUV entry is %r" % ent)
+            self.log.debug("RUV entry is %r", ent)
             return RUV(ent)
 
         raise NoSuchEntryError("RUV not found: suffix: %r" % suffix)
diff --git a/src/lib389/lib389/tasks.py b/src/lib389/lib389/tasks.py
index 66a2c57..3de2404 100644
--- a/src/lib389/lib389/tasks.py
+++ b/src/lib389/lib389/tasks.py
@@ -262,7 +262,7 @@ class Tasks(object):
         dn = entry.dn
         while not done:
             entry = self.conn.getEntry(dn, attrlist=attrlist)
-            self.log.debug("task entry %r" % entry)
+            self.log.debug("task entry %r", entry)
 
             if entry.nsTaskExitCode:
                 exitCode = int(entry.nsTaskExitCode)
@@ -331,11 +331,11 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: import task %s for file %s exited with %d" %
-                           (cn, input_file, exitCode))
+            self.log.error("Error: import task %s for file %s exited with %d",
+                           cn, input_file, exitCode)
         else:
-            self.log.info("Import task %s for file %s completed successfully" %
-                          (cn, input_file))
+            self.log.info("Import task %s for file %s completed successfully",
+                          cn, input_file)
         self.dn = dn
         self.entry = entry
         return exitCode
@@ -400,11 +400,11 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: export task %s for file %s exited with %d" %
-                           (cn, output_file, exitCode))
+            self.log.error("Error: export task %s for file %s exited with %d",
+                           cn, output_file, exitCode)
         else:
-            self.log.info("Export task %s for file %s completed successfully" %
-                          (cn, output_file))
+            self.log.info("Export task %s for file %s completed successfully",
+                          cn, output_file)
 
         self.dn = dn
         self.entry = entry
@@ -444,7 +444,7 @@ class Tasks(object):
         try:
             self.conn.add_s(entry)
         except ldap.ALREADY_EXISTS:
-            self.log.error("Fail to add the backup task (%s)" % dn)
+            self.log.error("Fail to add the backup task (%s)", dn)
             return -1
 
         exitCode = 0
@@ -452,10 +452,10 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: backup task %s exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: backup task %s exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("Backup task %s completed successfully" % (cn))
+            self.log.info("Backup task %s completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -506,7 +506,7 @@ class Tasks(object):
         try:
             self.conn.add_s(entry)
         except ldap.ALREADY_EXISTS:
-            self.log.error("Fail to add the backup task (%s)" % dn)
+            self.log.error("Fail to add the backup task (%s)", dn)
             return -1
 
         exitCode = 0
@@ -514,10 +514,10 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: restore task %s exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: restore task %s exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("Restore task %s completed successfully" % (cn))
+            self.log.info("Restore task %s completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -605,7 +605,7 @@ class Tasks(object):
         try:
             self.conn.add_s(entry)
         except ldap.ALREADY_EXISTS:
-            self.log.error("Fail to add the index task for %s" % attrname)
+            self.log.error("Fail to add the index task for %s", attrname)
             return -1
 
         exitCode = 0
@@ -613,10 +613,10 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: index task %s exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: index task %s exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("Index task %s completed successfully" % (cn))
+            self.log.info("Index task %s completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -692,12 +692,12 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: fixupMemberOf task %s for basedn %s exited with %d" %
-                (cn, suffix, exitCode))
+                "Error: fixupMemberOf task %s for basedn %s exited with %d",
+                cn, suffix, exitCode)
         else:
             self.log.info(
-                "fixupMemberOf task %s for basedn %s completed successfully" %
-                (cn, suffix))
+                "fixupMemberOf task %s for basedn %s completed successfully",
+                cn, suffix)
 
         self.dn = dn
         self.entry = entry
@@ -751,12 +751,14 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: tombstone fixup task %s for backend %s exited with %d"
-                % (cn, bename, exitCode))
+                "Error: tombstone fixup task %s for backend %s exited "
+                "with %d",
+                cn, bename, exitCode)
         else:
             self.log.info(
-                "tombstone fixup task %s for backend %s completed successfully"
-                % (cn, bename))
+                "tombstone fixup task %s for backend %s completed "
+                "successfully",
+                cn, bename)
 
         self.dn = dn
         self.entry = entry
@@ -799,12 +801,12 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: Automember Rebuild Membership task (%s) exited with %d"
-                % (cn, exitCode))
+                "Error: Automember Rebuild Membership task (%s) exited "
+                "with %d", cn, exitCode)
         else:
             self.log.info(
-                "Automember Rebuild Membership task(%s) completed successfully"
-                % (cn))
+                "Automember Rebuild Membership task(%s) completed"
+                "successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -852,12 +854,12 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: Automember Export Updates task (%s) exited with %d" %
-                (cn, exitCode))
+                "Error: Automember Export Updates task (%s) exited with %d",
+                cn, exitCode)
         else:
             self.log.info(
-                "Automember Export Updates task (%s) completed successfully" %
-                (cn))
+                "Automember Export Updates task (%s) completed successfully",
+                cn)
 
         self.dn = dn
         self.entry = entry
@@ -900,12 +902,11 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: Automember Map Updates task (%s) exited with %d" %
-                (cn, exitCode))
+                "Error: Automember Map Updates task (%s) exited with %d",
+                cn, exitCode)
         else:
             self.log.info(
-                "Automember Map Updates task (%s) completed successfully" %
-                (cn))
+                "Automember Map Updates task (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -943,12 +944,11 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: Fixup Linked Attributes task (%s) exited with %d" %
-                (cn, exitCode))
+                "Error: Fixup Linked Attributes task (%s) exited with %d",
+                cn, exitCode)
         else:
             self.log.info(
-                "Fixup Linked Attributes task (%s) completed successfully" %
-                (cn))
+                "Fixup Linked Attributes task (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -984,11 +984,10 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: Schema Reload task (%s) exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: Schema Reload task (%s) exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("Schema Reload task (%s) completed successfully" %
-                          (cn))
+            self.log.info("Schema Reload task (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -1028,11 +1027,11 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "fixupWinsyncMembers 'memberuid task' (%s) exited with %d" %
-                (cn, exitCode))
+                "fixupWinsyncMembers 'memberuid task' (%s) exited with %d",
+                cn, exitCode)
         else:
             self.log.info(
-                "'memberuid task' (%s) completed successfully" % (cn))
+                "'memberuid task' (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -1071,11 +1070,11 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: Syntax Validate (%s) exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: Syntax Validate (%s) exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("Syntax Validate task (%s) completed successfully" %
-                          (cn))
+            self.log.info("Syntax Validate task (%s) completed successfully",
+                          cn)
 
         self.dn = dn
         self.entry = entry
@@ -1120,12 +1119,11 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: USN tombstone cleanup task (%s) exited with %d" %
-                (cn, exitCode))
+                "Error: USN tombstone cleanup task (%s) exited with %d",
+                cn, exitCode)
         else:
             self.log.info(
-                "USN tombstone cleanup task (%s) completed successfully" %
-                (cn))
+                "USN tombstone cleanup task (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -1168,11 +1166,11 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: Sysconfig Reload task (%s) exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: Sysconfig Reload task (%s) exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("Sysconfig Reload task (%s) completed successfully" %
-                          (cn))
+            self.log.info("Sysconfig Reload task (%s) completed successfully",
+                          cn)
 
         self.dn = dn
         self.entry = entry
@@ -1217,11 +1215,10 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: cleanAllRUV task (%s) exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: cleanAllRUV task (%s) exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("cleanAllRUV task (%s) completed successfully" %
-                          (cn))
+            self.log.info("cleanAllRUV task (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -1271,12 +1268,11 @@ class Tasks(object):
 
         if exitCode:
             self.log.error(
-                "Error: Abort cleanAllRUV task (%s) exited with %d" %
-                (cn, exitCode))
+                "Error: Abort cleanAllRUV task (%s) exited with %d",
+                cn, exitCode)
         else:
             self.log.info(
-                "Abort cleanAllRUV task (%s) completed successfully" %
-                (cn))
+                "Abort cleanAllRUV task (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry
@@ -1322,10 +1318,10 @@ class Tasks(object):
             (done, exitCode) = self.conn.tasks.checkTask(entry, True)
 
         if exitCode:
-            self.log.error("Error: upgradedb task (%s) exited with %d" %
-                           (cn, exitCode))
+            self.log.error("Error: upgradedb task (%s) exited with %d",
+                           cn, exitCode)
         else:
-            self.log.info("Upgradedb task (%s) completed successfully" % (cn))
+            self.log.info("Upgradedb task (%s) completed successfully", cn)
 
         self.dn = dn
         self.entry = entry