I noticed there is code to dump the changelog to a flat file, but
it isn't clear to me how to call it
Aha! I poked through the code and figured it out:
Perform an ldapmodify against "cn=replica,cn=...,cn=mapping tree,cn=config"
adding the attribute "nsds5Task" with the value "CL2LDIF". It then
writes the LDIF file to the same directory that contains the changelog database files,
which is defined in the "nsslapd-changelogdir" attribute of
"cn=changelog5,cn=config", which, for me, is
"/var/lib/dirsrv/slapd-<DOMAIN>/cldb".
To be clear, here's the ldapmodify LDIF that worked for me:
dn: cn=replica,cn=...,cn=mapping tree,cn=config
changetype: modify
add: nsds5Task
nsds5Task: CL2LDIF
The LDIF that's created shows the actual changed data and not just a blob, which
certainly helps.