How to determine, source of change for the user --> replace: orclisenabled?

Oracle FMW 12.2.1.4, Java 1.8.x, RHEL 7.x and DB 12.x

We see in our OID Logs entry as follows:

2023-05-25T11:43:13.777502 *   replace: orclisenabled

2023-05-25T11:43:13.777515 * gslfmeADoModify:conn=1386948 op=324 MOD dn="cn=userxx,cn=edir,cn=users,dc=xxxxx,dc=xx"

2023-05-25T11:43:13.779653 * gslusrnWriteToRemNodes: Sent 18141 ;0 change notification to node <oidHostname>

2023-05-25T11:43:13.779733 * Replacing orclisenabled in gslsbmApplyModtoEntry()

2023-05-25T11:43:13.785970 * gslusrnWriteToRemNodes: Sent 18141 ;1 change notification to node <oidHostname>

2023-05-25T11:43:13.786051 * INFO:gsleswrASndResult OPtime=8801 micro sec Qtime=24 micro sec DBtime=1637469 micro sec RESULT=0 tag=103 nentries=0

END

]]

How to determine, source of change for the user -->> replace: orclisenabled?

Any help would be appreciable.