- openldap-bugs - openldap.org

Re: (ITS#5079) Sourious warnings in slapd-bdb/hdb about missing objectClass at add
by ando＠sys-net.it 08 Aug '07

08 Aug '07

quanah(a)zimbra.com wrote: > CVS log for servers/slapd/back-bdb/search.c > 1.221.2.16 Fri Jul 20 22:42:26 2007 UTC; 2 weeks, 4 days ago by hyc > Branch: OPENLDAP_REL_ENG_2_3 > Changed since 1.221.2.15: +2 -1 lines > Diffs to 1.221.2.15 (colored diff) > > Set e_ocflags on dummy context entry That's for search; I'm seeing it during add. I copied the fix from HEAD, mine differs from that of Howard. Maybe we should converge to a common one... p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5073) Syncrepl spinlock
by quanah＠zimbra.com 08 Aug '07

08 Aug '07

--On Wednesday, August 08, 2007 1:05 PM +0000 ando(a)sys-net.it wrote: > I vote for the first. Me too. ;) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5079) Sourious warnings in slapd-bdb/hdb about missing objectClass at add
by quanah＠zimbra.com 08 Aug '07

08 Aug '07

--On Wednesday, August 08, 2007 4:24 PM +0000 ando(a)sys-net.it wrote: > Full_Name: Pierangelo Masarati > Version: 2.3 > OS: irrelevant > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (81.72.89.40) > Submitted by: ando > > > When adding an entry rooted at "" to a back-bdb/hdb configured for the > empty suffix, warnings about the objectClass attribute being missing are > issued because a dummy root entry is checked for being an alias, a > referral and so. This has already been fixed in HEAD long ago, but > apparently, since no ITS was opened, the fix was not backported to 2.3. > It is not a showstopper, but it causes annoying spurious warnings to be > logged. I thought Howard fixed this just a little while ago? CVS log for servers/slapd/back-bdb/search.c 1.221.2.16 Fri Jul 20 22:42:26 2007 UTC; 2 weeks, 4 days ago by hyc Branch: OPENLDAP_REL_ENG_2_3 Changed since 1.221.2.15: +2 -1 lines Diffs to 1.221.2.15 (colored diff) Set e_ocflags on dummy context entry --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5079) Sourious warnings in slapd-bdb/hdb about missing objectClass at add
by ando＠sys-net.it 08 Aug '07

08 Aug '07

Full_Name: Pierangelo Masarati Version: 2.3 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.72.89.40) Submitted by: ando When adding an entry rooted at "" to a back-bdb/hdb configured for the empty suffix, warnings about the objectClass attribute being missing are issued because a dummy root entry is checked for being an alias, a referral and so. This has already been fixed in HEAD long ago, but apparently, since no ITS was opened, the fix was not backported to 2.3. It is not a showstopper, but it causes annoying spurious warnings to be logged. p.

1 0

Re: (ITS#5073) Syncrepl spinlock
by ando＠sys-net.it 08 Aug '07

08 Aug '07

> Okay, I figured it out -- This is definitely a misconfiguration type > scenario... > > The database is something like: > > database bdb > base "dc=example,dc=com" > > ... > > Then the syncrepl config has: > searchbase="" > > I'm not sure this is something that should be allowed -- where the search > base is broader than the database. I'm not sure either, but in any case this is triggering a bug: an internal search is performed with base "" and scope "sub"; even though the database is configured to serve "dc=example,dc=com", it answers "success" with no data, since it erroneously treats itself as if handling the empty suffix. I think the bug here is that an internal search should never be invoked without making sure whether the base is within the naming context of the database. If the above configuration does not make sense, the check can be done at configuration; otherwise, it needs to be dealt with from within syncrepl_entry(). I vote for the first. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5078) slapd high cpu usage
by marg＠rz.tu-clausthal.de 08 Aug '07

08 Aug '07

Hello, Babu.Suresh(a)pacificlife.com wrote: > bdb_db_open: Warning - No DB_CONFIG file found in directory=20 > Expect poor performance for suffix o=3Dpacificlife.com. Well, slapd even gives you hints for better performance... > <=3D bdb_equality_candidates: (uid) index_param failed (18) > <=3D bdb_equality_candidates: (cn) index_param failed (18) > <=3D bdb_equality_candidates: (uniqueMember) index_param failed (18) Obviously there are some indices missing in the Database. First add configuration for indices cn, uniquemember then re-index/rebuild database. bye Christian -- Christian Marg mail : mailto:marg@rz.tu-clausthal.de Dezernat 2 TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2107 Germany jabber: ifcma(a)jabber.tu-clausthal.de

1 0

Re: (ITS#5078) slapd high cpu usage
by ando＠sys-net.it 07 Aug '07

07 Aug '07

Please do not post in HTML. p. Babu.Suresh(a)pacificlife.com wrote: > This is a multi-part message in MIME format. <snip> Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

RE: Re: (ITS#5078) slapd high cpu usage
by Babu.Suresh＠pacificlife.com 07 Aug '07

07 Aug '07

This is a multi-part message in MIME format. ------_=_NextPart_001_01C7D93E.7410BF9A Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable OpenLDAP version we are using is - 2.3.32=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DHere is the debug log of one = login=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D bdb_db_open: Warning - No DB_CONFIG file found in directory=20 Expect poor performance for suffix o=3Dpacificlife.com. slapd starting conn=3D0 fd=3D10 ACCEPT from IP=3Dxxxxxxxxx) conn=3D0 op=3D0 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D0 op=3D0 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = mech=3DSIMPLE ssf=3D0 conn=3D0 op=3D0 RESULT tag=3D97 err=3D0 text=3D conn=3D0 op=3D1 SRCH base=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxxm= "= scope=3D1 deref=3D0 filter=3D"(&(uid=3Dxxxxxxx)(objectClass=3Dperson))" conn=3D0 op=3D1 SRCH attr=3D1.1 <=3D bdb_equality_candidates: (uid) index_param failed (18) conn=3D0 op=3D2 BIND anonymous mech=3Dimplicit ssf=3D0 conn=3D0 op=3D2 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D0 op=3D2 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = mech=3DSIMPLE ssf=3D0 conn=3D0 op=3D2 RESULT tag=3D97 err=3D0 text=3D conn=3D0 op=3D3 BIND anonymous mech=3Dimplicit ssf=3D0 conn=3D0 op=3D3 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D0 op=3D3 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = mech=3DSIMPLE ssf=3D0 conn=3D0 op=3D3 RESULT tag=3D97 err=3D0 text=3D conn=3D1 fd=3D12 ACCEPT from IP=3D12.12.1.11:40660 = (IP=3D10.141.1.217:121212) conn=3D1 op=3D0 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D1 op=3D0 BIND dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = mech=3DSIMPLE ssf=3D0 conn=3D1 op=3D0 RESULT tag=3D97 err=3D0 text=3D conn=3D1 op=3D1 SRCH base=3D"ou=3DPeople,ou=3DInternet,o=3Dpacificlife.com"= = scope=3D1 deref=3D0 filter=3D"(&(uid=3Dplevone)(objectClass=3Dperson))" conn=3D1 op=3D1 SRCH attr=3D1.1 <=3D bdb_equality_candidates: (uid) index_param failed (18) conn=3D1 op=3D2 SRCH base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 = deref=3D0 =66ilter=3D"(&(uniqueMember=3Duid=3Dplevone,ou=3Dpeople,ou=3Dinternet,o=3Dp= acificlife. com)(objectClass=3DgroupOfUniqueNames))" conn=3D1 op=3D2 SRCH attr=3Dcn <=3D bdb_equality_candidates: (uniqueMember) index_param failed (18) conn=3D0 op=3D4 SRCH base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 = deref=3D0 =66ilter=3D"(|(&(cn=3Dpresenters)(objectClass=3DgroupOfUniqueNames))(&(cn= =3Dpresen ters)(objectClass=3DgroupOfURLs)))" conn=3D0 op=3D4 SRCH attr=3D1.1 <=3D bdb_equality_candidates: (cn) index_param failed (18) <=3D bdb_equality_candidates: (cn) index_param failed (18) conn=3D0 op=3D5 SRCH base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 = deref=3D0 =66ilter=3D"(&(uniqueMember=3Dcn=3Dpresenters,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxx= xxx)(object Class=3DgroupOfUniqueNames))" conn=3D0 op=3D5 SRCH attr=3Dcn <=3D bdb_equality_candidates: (uniqueMember) index_param failed (18) conn=3D1 op=3D2 SEARCH RESULT tag=3D101 err=3D0 nentries=3D1 text=3D conn=3D0 op=3D4 SEARCH RESULT tag=3D101 err=3D0 nentries=3D1 text=3D conn=3D0 op=3D5 SEARCH RESULT tag=3D101 err=3D0 nentries=3D0 text=3D conn=3D1 op=3D3 SRCH base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 = deref=3D0 =66ilter=3D"(objectClass=3DgroupOfURLs)" conn=3D1 op=3D3 SRCH attr=3Dcn memberURL conn=3D1 op=3D3 SEARCH RESULT tag=3D101 err=3D0 nentries=3D0 text=3D conn=3D1 op=3D1 SEARCH RESULT tag=3D101 err=3D0 nentries=3D1 text=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ---------------------------------------------------------------------------= --- The information in this e-mail and any attachments are for the sole use of = the intended recipient and may contain privileged and confidential = information. If you are not the intended recipient, any use, disclosure, = copying or distribution of this message or attachment is strictly = prohibited. If you believe that you have received this e-mail in error, = please contact the sender immediately and delete the e-mail and all of its = attachments. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D ------_=_NextPart_001_01C7D93E.7410BF9A Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version 6.5.7651.59"> <TITLE>RE: Re: (ITS#5078) slapd high cpu usage</TITLE> </HEAD> <BODY>  OpenLDAP version we are = using is - 2.3.32 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DHere is the debug log of = one login=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D bdb_db_open: Warning - = No DB_CONFIG file found in directory Expect poor performance= = =66or suffix o=3Dpacificlife.com. slapd starting conn=3D0 fd=3D10 ACCEPT= = =66rom IP=3Dxxxxxxxxx) conn=3D0 op=3D0 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D0 op=3D0 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" mech=3DSIMPL= E= ssf=3D0 conn=3D0 op=3D0 RESULT = tag=3D97 err=3D0 text=3D conn=3D0 op=3D1 SRCH = base=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxxm" scope=3D1= = deref=3D0 = =66ilter=3D"(&(uid=3Dxxxxxxx)(objectClass=3Dperson))"<= /P> conn=3D0 op=3D1 SRCH = attr=3D1.1 <=3D = bdb_equality_candidates: (uid) index_param failed (18) conn=3D0 op=3D2 BIND = anonymous mech=3Dimplicit ssf=3D0 conn=3D0 op=3D2 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D0 op=3D2 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" mech=3DSIMPL= E= ssf=3D0 conn=3D0 op=3D2 RESULT = tag=3D97 err=3D0 text=3D conn=3D0 op=3D3 BIND = anonymous mech=3Dimplicit ssf=3D0 conn=3D0 op=3D3 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D0 op=3D3 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" mech=3DSIMPL= E= ssf=3D0 conn=3D0 op=3D3 RESULT = tag=3D97 err=3D0 text=3D conn=3D1 fd=3D12 ACCEPT= = =66rom IP=3D12.12.1.11:40660 (IP=3D10.141.1.217:121212) conn=3D1 op=3D0 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" = method=3D128 conn=3D1 op=3D0 BIND = dn=3D"uid=3Dxxxxxx,ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" mech=3DSIMPL= E= ssf=3D0 conn=3D1 op=3D0 RESULT = tag=3D97 err=3D0 text=3D conn=3D1 op=3D1 SRCH = base=3D"ou=3DPeople,ou=3DInternet,o=3Dpacificlife.com" scope=3D1 = deref=3D0 = =66ilter=3D"(&(uid=3Dplevone)(objectClass=3Dperson))"<= /P> conn=3D1 op=3D1 SRCH = attr=3D1.1 <=3D = bdb_equality_candidates: (uid) index_param failed (18) conn=3D1 op=3D2 SRCH = base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 deref=3D0 = =66ilter=3D"(&(uniqueMember=3Duid=3Dplevone,ou=3Dpeople,ou=3Dinter= net,o=3Dpacificlife.com)(objectClass=3DgroupOfUniqueNames))" conn=3D1 op=3D2 SRCH = attr=3Dcn <=3D = bdb_equality_candidates: (uniqueMember) index_param failed (18) conn=3D0 op=3D4 SRCH = base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 deref=3D0 = =66ilter=3D"(|(&(cn=3Dpresenters)(objectClass=3DgroupOfUniqueNames= ))(&(cn=3Dpresenters)(objectClass=3DgroupOfURLs)))" conn=3D0 op=3D4 SRCH = attr=3D1.1 <=3D = bdb_equality_candidates: (cn) index_param failed (18) <=3D = bdb_equality_candidates: (cn) index_param failed (18) conn=3D0 op=3D5 SRCH = base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 deref=3D0 = =66ilter=3D"(&(uniqueMember=3Dcn=3Dpresenters,ou=3Dxxxxxxx,ou=3Dxx= xx,o=3Dxxxxx)(objectClass=3DgroupOfUniqueNames))" conn=3D0 op=3D5 SRCH = attr=3Dcn <=3D = bdb_equality_candidates: (uniqueMember) index_param failed (18) conn=3D1 op=3D2 SEARCH = RESULT tag=3D101 err=3D0 nentries=3D1 text=3D conn=3D0 op=3D4 SEARCH = RESULT tag=3D101 err=3D0 nentries=3D1 text=3D conn=3D0 op=3D5 SEARCH = RESULT tag=3D101 err=3D0 nentries=3D0 text=3D conn=3D1 op=3D3 SRCH = base=3D"ou=3Dxxxxxxx,ou=3Dxxxx,o=3Dxxxxx" scope=3D1 deref=3D0 = =66ilter=3D"(objectClass=3DgroupOfURLs)" conn=3D1 op=3D3 SRCH = attr=3Dcn memberURL conn=3D1 op=3D3 SEARCH = RESULT tag=3D101 err=3D0 nentries=3D0 text=3D conn=3D1 op=3D1 SEARCH = RESULT tag=3D101 err=3D0 nentries=3D1 text=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D <pre = wrap>----------------------------------------------------------------------= -------- The information in this e-mail and any attachments are for the sole use of = the intended recipient and may contain privileged and confidential = information. If you are not the intended recipient, any use, disclosure, = copying or distribution of this message or attachment is strictly = prohibited. If you believe that you have received this e-mail in error, = please contact the sender immediately and delete the e-mail and all of its = attachments. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D </pre></BODY> </HTML> ------_=_NextPart_001_01C7D93E.7410BF9A--

1 0

Re: (ITS#5078) slapd high cpu usage
by Babu.Suresh＠pacificlife.com 07 Aug '07

07 Aug '07

This is a multi-part message in MIME format. ------_=_NextPart_001_01C7D93C.273C1782 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable thank you Quanah for your quick response. see bellow.. What version of OpenLDAP 2.3=3F -->V2.3.4 Have you configured the DB_CONFIG file=3F -->NO You can still use cachesize whether or not it is restarted nightly. -->will do Have you examined the logs at loglevel 256 to see what kind of searches are being performed, so you can optimize your indices=3F -->yes, we did but I didn't put much attention to this. I will perform again and post the output. thank you ---------------------------------------------------------------------------= --- The information in this e-mail and any attachments are for the sole use of = the intended recipient and may contain privileged and confidential = information. If you are not the intended recipient, any use, disclosure, = copying or distribution of this message or attachment is strictly = prohibited. If you believe that you have received this e-mail in error, = please contact the sender immediately and delete the e-mail and all of its = attachments. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D ------_=_NextPart_001_01C7D93C.273C1782 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version 6.5.7651.59"> <TITLE>Re: (ITS#5078) slapd high cpu usage</TITLE> </HEAD> <BODY>  thank you Quanah for your quick = response. see bellow.. What version of OpenLDAP = 2.3=3F -->V2.3.4 Have you configured the DB_CONFIG = =66ile=3F -->NO You can still use cachesize whether= = or not it is restarted nightly. -->will do Have you examined the logs at = loglevel 256 to see what kind of searches are being performed, so you can = optimize your indices=3F -->yes, we did but I didn't put = much attention to this. I will perform again and post the output. thank you <pre = wrap>----------------------------------------------------------------------= -------- The information in this e-mail and any attachments are for the sole use of = the intended recipient and may contain privileged and confidential = information. If you are not the intended recipient, any use, disclosure, = copying or distribution of this message or attachment is strictly = prohibited. If you believe that you have received this e-mail in error, = please contact the sender immediately and delete the e-mail and all of its = attachments. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D </pre></BODY> </HTML> ------_=_NextPart_001_01C7D93C.273C1782--

1 0

Re: (ITS#5078) slapd high cpu usage
by quanah＠zimbra.com 07 Aug '07

07 Aug '07

--On Tuesday, August 07, 2007 6:25 PM +0000 babu.suresh(a)pacificlife.com wrote: > Full_Name: Babu > Version: 2.3 > OS: RedHAT3 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (198.181.11.27) > > > Hello, > > > We are using openldap2.3, BDB 4.5.20 and Rehat3..seeing having high cpu > usage of the slapd process. What version of OpenLDAP 2.3? Have you configured the DB_CONFIG file? You can still use cachesize whether or not it is restarted nightly. Have you examined the logs at loglevel 256 to see what kind of searches are being performed, so you can optimize your indices? In any case, I see no bug here. Please redirect further questions and response to openldap-software(a)openldap.org --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5078) slapd high cpu usage
by babu.suresh＠pacificlife.com 07 Aug '07

07 Aug '07

Full_Name: Babu Version: 2.3 OS: RedHAT3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (198.181.11.27) Hello, We are using openldap2.3, BDB 4.5.20 and Rehat3..seeing having high cpu usage of the slapd process. Tried with bellow indexes, we can't use "cachesize" as we have nightly restart of the process and cache go away (let me know there is way to save cache and it will be available even after restart of slapd); also we have yearly onetime users in our system. Please let me know what are can be done to solve slapd high cpu utilization problem. ====indexes in slapd.conf==== index objectClass eq index uid pres, eq ========= =========CPU usage with 3/4 users concurrent login========= 321 processes: 319 sleeping, 2 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 28.0% 0.0% 7.8% 0.0% 0.0% 7.9% 56.0% cpu00 47.6% 0.0% 8.9% 0.0% 0.3% 2.3% 40.6% cpu01 32.8% 0.0% 7.7% 0.0% 0.0% 0.7% 58.6% cpu02 19.4% 0.0% 8.1% 0.0% 0.0% 14.1% 58.2% cpu03 12.1% 0.0% 6.5% 0.0% 0.0% 14.5% 66.7% PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 30973 xxxxx 19 0 148M 148M 2224 R 15.4 3.1 4:44 0 slapd 30975 xxxxx 18 0 148M 148M 2224 S 9.5 3.1 3:51 3 slapd 32030 xxxxxx 19 0 148M 148M 2224 S 7.9 3.1 3:59 1 slapd

1 0

Coredump on ACLs for nonexistent Attributes. Is it a bug?
by Christian Marg 07 Aug '07

07 Aug '07

Hello, I didn't find an ITS concerning what I encountered yesterday: I had ACLs defined for undefined attributes (e.g. a schema file was missing some entries) and slaptest etc. crashed with dumped core. The message I got was: slaptest in free(): error: junk pointer, too high to make sense Abort (core dumped) I'm using v 2.3.34 on FreeBSD 6.2-RELEASE-p3. bye Christian -- Christian Marg mail : mailto:marg@rz.tu-clausthal.de Dezernat 2 TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2107 Germany jabber: ifcma(a)jabber.tu-clausthal.de

2 2

Re: Contribution: Active Directory Password Cache (ITS#5042)
by ando＠sys-net.it 07 Aug '07

07 Aug '07

ando(a)sys-net.it wrote: > At this point, it sounds like that your contribution could be > __entirely__ reworked into simply adding caching capabilities into the > current {SASL} password scheme (implemented in servers/slapd/sasl.c), > preserving the logics you're using right now. You'd probably need to > define your own "cachedUserPassword" attribute to temporarily store the > cached credentials, unless something like this: > > userPassword: {SASL}user > userPassword: {<hash>}<hashed password> > > allows the {SASL} module to fetch the next value of the userPassowrd and > treat it as the cached value. The rest would be adding some TTL mech, > configurable via back-config, and that should be it. > > Yet another option would be to allow per-entry caching, by defining a > new {CACHED-SASL} scheme. This way, one could fine-grain decide whose > credentials can be cached and whose can't, letting the two cases share > most of the code. I'd allow {SASL} to be cached as well, in case the > administrator just wants to allow all {SASL} auths to be cached. For this purpose, it might be necessary to change the API of password scheme handling, so that it gets passed a pointer to the entire entry, read-only locked, so that attributes like the "cachedPwd" and the "cachedPwdTimestamp" can be fetched and used. With respect to updating them, we might need to add some means to schedule internal modifications to be performed as soon as the entry lock is released. Thoughts? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by ando＠sys-net.it 07 Aug '07

07 Aug '07

s.hetze(a)linux-ag.de wrote: > Renaming the variables is no problem. What would you say extpwc stands > for? EXT ernal P ass W ord C ache? > I can imagine to call the module krb5pwc and head the README > "Kerberos V/Active Directory Password Cache" Right; but, this would limit yourself to Kerberos V; see my other posting about rather delegating auth to SASL. >> Well, that could be a parameter that is provided through the >> configuration (caching TTL, optional negative caching TTL, and so). It >> doesn't need to be stored in the entry, or in a subentry, since dynamic >> configuration would allow to modify it run-time anyway. >> > > If I understand it correct, you suggest to let the cached password > expire after some configurable time. To achieve this, I would need to > keep a timestamp when the password was cached. > Is there any other way than to add an attribute holding this timestamp? > ... > Actually, I could make this feature depend on the {ad|krb5}pw-cache-mode=any > and use the sambaPwdLastSet attribute. Right; I think a specific operational attribute would be better. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by s.hetze＠linux-ag.de 07 Aug '07

07 Aug '07

Hi Pierangelo, On Tue, Aug 07, 2007 at 11:41:58AM +0200, Pierangelo Masarati wrote: > s.hetze(a)linux-ag.de wrote: > > >>2) you could try to rework the overlay to avoid any specific reference > >>to Active Directory, since your cache should apply to any remote system > >>implementing Kerberos V. It could be abstracted even more, to act as a > >>replacement of saslauthd, by allowing it to auth via LDAP, pam and more, > >>not just Kerberos. > > > >Actually, the software was built and tested agains MIT and Heimdal > >Kerberos V in the first place, so there is no dependency on AD > >whatsoever. The reference to AD is more a marketing issue. I assume > >more users looking for an AD password cache than for an Kerberos V > >password cache. So I would perfer to keep it. > > I understand this, and I think it's just fine to advertise it like that, > but in the code I'd prefer to avoid, for example, naming all variables > after "ad" something. Perhaps s/adpwc/extpwc/ would be a little bit better? Renaming the variables is no problem. What would you say extpwc stands for? I can imagine to call the module krb5pwc and head the README "Kerberos V/Active Directory Password Cache" > > >>3) you should add a (configurable) TTL, so that the cache could > >>eventually be notified of an account lockout at the remote server's side. > > > >I tried to avoid introduction of new attributes for the module. Do you > >have any suggestions how this TTL should be stored? Adding pwdPolicy > >from ppolicy seems a bit like an overkill to me. > > Well, that could be a parameter that is provided through the > configuration (caching TTL, optional negative caching TTL, and so). It > doesn't need to be stored in the entry, or in a subentry, since dynamic > configuration would allow to modify it run-time anyway. > If I understand it correct, you suggest to let the cached password expire after some configurable time. To achieve this, I would need to keep a timestamp when the password was cached. Is there any other way than to add an attribute holding this timestamp? ... Actually, I could make this feature depend on the {ad|krb5}pw-cache-mode=any and use the sambaPwdLastSet attribute. > >>4) you should add support for dynamic configuration, so that the module > >>can fit into the new configuration paradigm for possible release with 2.4. > > > >I'll look into that. > > If you need help, please holler. However, I see that for such a simple > (from a configuration point of view) module, looking into smbk5pwd > should suffice. Thanx for your offer, and I agree to look into the existing overlays (again ;-) That's the fun with free software! Regards, Sebastian

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by ando＠sys-net.it 07 Aug '07

07 Aug '07

s.hetze(a)linux-ag.de wrote: > I don't see the benefit of delegating the password cache mechanism to > saslauthd or a possible replacement. Wouldn't I have to implement each > possible password store anyway? > If I understand it correct, the {SASL} userPassword mechanism delegates > authentication to saslauthd. > saslauthd can easily authenticate against Kerberos and AD and it is > possible let it cache the password for its own authentication purposes. > If I want the sambaNTPassword attribute to be available (to be able to > run samba as a NT4 PDC independent of AD ) or if I want to have the > password additionally cached as MIT Kerberos credential, I would need > to implement both individually one way or another. > So why not going the short way and let the overlay module do this? The {SASL} userPassword delegates authentication to SASL; then, by configuring SASL to use saslauthd, SASL delegates authentication to saslauthd, but it can be delegated to anything else. I think the point is: you should isolate what your piece of software is originally contributing, and what it's "reinventing". The original contribution, as far as I understand, is the capability to cache athentication rather than always propagating it. This capability is not currently present in OpenLDAP. What is already present is the SASL, which is an abstraction layer for authentication; think of it as a superset of Kerberos, which is the only authentication method you're considering in your piece of software. At this point, it sounds like that your contribution could be __entirely__ reworked into simply adding caching capabilities into the current {SASL} password scheme (implemented in servers/slapd/sasl.c), preserving the logics you're using right now. You'd probably need to define your own "cachedUserPassword" attribute to temporarily store the cached credentials, unless something like this: userPassword: {SASL}user userPassword: {<hash>}<hashed password> allows the {SASL} module to fetch the next value of the userPassowrd and treat it as the cached value. The rest would be adding some TTL mech, configurable via back-config, and that should be it. Yet another option would be to allow per-entry caching, by defining a new {CACHED-SASL} scheme. This way, one could fine-grain decide whose credentials can be cached and whose can't, letting the two cases share most of the code. I'd allow {SASL} to be cached as well, in case the administrator just wants to allow all {SASL} auths to be cached. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by s.hetze＠linux-ag.de 07 Aug '07

07 Aug '07

Hi Kurt, On Mon, Aug 06, 2007 at 12:55:11PM -0700, Kurt Zeilenga wrote: > >2) you could try to rework the overlay to avoid any specific reference > >to Active Directory, since your cache should apply to any remote > >system > >implementing Kerberos V. It could be abstracted even more, to act > >as a > >replacement of saslauthd, by allowing it to auth via LDAP, pam and > >more, > >not just Kerberos. > > s/to act as a replacement/to defer external authentication to saslauthd > or the like/ > > In slapd(8), we deferred verification against external password > stores to saslauthd > via the {SASL} userPassword mechanism, thus avoiding needing to > implement > and support each possible external password store (such as a KDC). > This module > should likewise avoid supporting (some subset of) external passwords > stores. > saslauthd(8) can easily be extended (or replaced) to support additional > password stores as needed. As provided in Cyrus SASL today, it > supports both > LDAP and Kerberos as external password stores. > I don't see the benefit of delegating the password cache mechanism to saslauthd or a possible replacement. Wouldn't I have to implement each possible password store anyway? If I understand it correct, the {SASL} userPassword mechanism delegates authentication to saslauthd. saslauthd can easily authenticate against Kerberos and AD and it is possible let it cache the password for its own authentication purposes. If I want the sambaNTPassword attribute to be available (to be able to run samba as a NT4 PDC independent of AD ) or if I want to have the password additionally cached as MIT Kerberos credential, I would need to implement both individually one way or another. So why not going the short way and let the overlay module do this? Regards, Sebastian

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by ando＠sys-net.it 07 Aug '07

07 Aug '07

s.hetze(a)linux-ag.de wrote: >> 2) you could try to rework the overlay to avoid any specific reference >> to Active Directory, since your cache should apply to any remote system >> implementing Kerberos V. It could be abstracted even more, to act as a >> replacement of saslauthd, by allowing it to auth via LDAP, pam and more, >> not just Kerberos. > > Actually, the software was built and tested agains MIT and Heimdal > Kerberos V in the first place, so there is no dependency on AD > whatsoever. The reference to AD is more a marketing issue. I assume > more users looking for an AD password cache than for an Kerberos V > password cache. So I would perfer to keep it. I understand this, and I think it's just fine to advertise it like that, but in the code I'd prefer to avoid, for example, naming all variables after "ad" something. Perhaps s/adpwc/extpwc/ would be a little bit better? >> 3) you should add a (configurable) TTL, so that the cache could >> eventually be notified of an account lockout at the remote server's side. > > I tried to avoid introduction of new attributes for the module. Do you > have any suggestions how this TTL should be stored? Adding pwdPolicy > from ppolicy seems a bit like an overkill to me. Well, that could be a parameter that is provided through the configuration (caching TTL, optional negative caching TTL, and so). It doesn't need to be stored in the entry, or in a subentry, since dynamic configuration would allow to modify it run-time anyway. >> 4) you should add support for dynamic configuration, so that the module >> can fit into the new configuration paradigm for possible release with 2.4. > > I'll look into that. If you need help, please holler. However, I see that for such a simple (from a configuration point of view) module, looking into smbk5pwd should suffice. >> 5) you should follow coding guidelines (indentation and so) as in most >> of the code. > > I did not find any guidelines other than "Adapt your style to match that > of the block, file, directory, or package that you are working in." > Can you point me to a more detailed explanation of the required > indentation? There isn't actually, but looking into any "recent" piece of code would suffice; things like: use tabs for indent, leave spaces in brackets and so... not a big deal, though. Cheers, p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by s.hetze＠linux-ag.de 07 Aug '07

07 Aug '07

Hi Pierangelo, thanx for your comments. On Mon, Aug 06, 2007 at 09:32:27PM +0200, Pierangelo Masarati wrote: > Sebastian, > > Thanks for the contribution. > > I have a few comments (also gathered from others): > > 1) you should provide patches against HEAD code; there has been some > limited changes in the API related to overlay initialization and so. No problem, I will look into that shortly. > > 2) you could try to rework the overlay to avoid any specific reference > to Active Directory, since your cache should apply to any remote system > implementing Kerberos V. It could be abstracted even more, to act as a > replacement of saslauthd, by allowing it to auth via LDAP, pam and more, > not just Kerberos. Actually, the software was built and tested agains MIT and Heimdal Kerberos V in the first place, so there is no dependency on AD whatsoever. The reference to AD is more a marketing issue. I assume more users looking for an AD password cache than for an Kerberos V password cache. So I would perfer to keep it. > > 3) you should add a (configurable) TTL, so that the cache could > eventually be notified of an account lockout at the remote server's side. I tried to avoid introduction of new attributes for the module. Do you have any suggestions how this TTL should be stored? Adding pwdPolicy from ppolicy seems a bit like an overkill to me. > > 4) you should add support for dynamic configuration, so that the module > can fit into the new configuration paradigm for possible release with 2.4. I'll look into that. > > 5) you should follow coding guidelines (indentation and so) as in most > of the code. I did not find any guidelines other than "Adapt your style to match that of the block, file, directory, or package that you are working in." Can you point me to a more detailed explanation of the required indentation? Regards, Sebastian

1 0

(ITS#5077) syncrepl.add_cmp() infinite loop on swapped values
by donn＠u.washington.edu 06 Aug '07

06 Aug '07

Full_Name: Donn Cave Version: 2.4.4 OS: Red Hat Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (128.95.135.150) In "while" loop at 2656, I find old->a_vals are like [..., a, b, ...] and new->a_vals are like [..., b, a, ...]. Matches are found at old [i] == new [k = j+1] and old [k = i+1] == new [j], but this just shows that neither an add nor a delete is called for, and the loop end is reached without having incremented i or j. Actual attribute values I'm looking at right now in the debugger are eduPersonAffiliation: old [ member, alum, employee, faculty ], new [ member, alum, faculty, employee ]. I built the replica from a slapcat dump on the idle master, started the slapd syncrepl client and applied a lot of normal modifications to the master, until it hit the infinite loop. It has been a recurrent problem.

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by kurt＠OpenLDAP.org 06 Aug '07

06 Aug '07

On Aug 6, 2007, at 7:31 PM, ando(a)sys-net.it wrote: > Sebastian, > > Thanks for the contribution. > > I have a few comments (also gathered from others): > > 1) you should provide patches against HEAD code; there has been some > limited changes in the API related to overlay initialization and so. > > 2) you could try to rework the overlay to avoid any specific reference > to Active Directory, since your cache should apply to any remote > system > implementing Kerberos V. It could be abstracted even more, to act > as a > replacement of saslauthd, by allowing it to auth via LDAP, pam and > more, > not just Kerberos. s/to act as a replacement/to defer external authentication to saslauthd or the like/ In slapd(8), we deferred verification against external password stores to saslauthd via the {SASL} userPassword mechanism, thus avoiding needing to implement and support each possible external password store (such as a KDC). This module should likewise avoid supporting (some subset of) external passwords stores. saslauthd(8) can easily be extended (or replaced) to support additional password stores as needed. As provided in Cyrus SASL today, it supports both LDAP and Kerberos as external password stores. > > 3) you should add a (configurable) TTL, so that the cache could > eventually be notified of an account lockout at the remote server's > side. > > 4) you should add support for dynamic configuration, so that the > module > can fit into the new configuration paradigm for possible release > with 2.4. > > 5) you should follow coding guidelines (indentation and so) as in most > of the code. > > p.

1 0

Re: Contribution: Active Directory Password Cache (ITS#5042)
by ando＠sys-net.it 06 Aug '07

06 Aug '07

Sebastian, Thanks for the contribution. I have a few comments (also gathered from others): 1) you should provide patches against HEAD code; there has been some limited changes in the API related to overlay initialization and so. 2) you could try to rework the overlay to avoid any specific reference to Active Directory, since your cache should apply to any remote system implementing Kerberos V. It could be abstracted even more, to act as a replacement of saslauthd, by allowing it to auth via LDAP, pam and more, not just Kerberos. 3) you should add a (configurable) TTL, so that the cache could eventually be notified of an account lockout at the remote server's side. 4) you should add support for dynamic configuration, so that the module can fit into the new configuration paradigm for possible release with 2.4. 5) you should follow coding guidelines (indentation and so) as in most of the code. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5073) Syncrepl spinlock
by quanah＠zimbra.com 06 Aug '07

06 Aug '07

--On August 6, 2007 5:01:08 PM +0000 quanah(a)zimbra.com wrote: > > > --On August 6, 2007 9:17:01 AM +0000 ando(a)sys-net.it wrote: > >> quanah(a)OpenLDAP.org wrote: >>> Full_Name: Quanah Gibson-Mount >>> Version: 2.3.37 >>> OS: Linux >>> URL: >>> Submission from: (NULL) (71.202.148.128) >>> >>> >>> If you create a syncrepl master that serves the "" base, and then set up >>> a syncrepl consumer to pull down "dc=example,dc=com", which does *not* >>> exist on the master, the replica will sit at 100% CPU, endlessly trying >>> to add nothing. >> >> I'm not observing this with either re23 nor HEAD. The initial search >> correctly fails with noSuchObject, and then both slapds sit at 0% CPU. >> Can you give further details? > > I'll look at reproducing it again. > > In this particular case, the master had a database rooted at "", with > some data around "cn=zimbra" contained in it. A replica was configured > as a syncrepl client, but with "dc=example,dc=com" as its base, by > mistake. This resulted in the CPU usage shooting to 100% on the replica, > and the logs showing it trying to add without success. Okay, I figured it out -- This is definitely a misconfiguration type scenario... The database is something like: database bdb base "dc=example,dc=com" ... Then the syncrepl config has: searchbase="" I'm not sure this is something that should be allowed -- where the search base is broader than the database. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5073) Syncrepl spinlock
by quanah＠zimbra.com 06 Aug '07

06 Aug '07

--On August 6, 2007 9:17:01 AM +0000 ando(a)sys-net.it wrote: > quanah(a)OpenLDAP.org wrote: >> Full_Name: Quanah Gibson-Mount >> Version: 2.3.37 >> OS: Linux >> URL: >> Submission from: (NULL) (71.202.148.128) >> >> >> If you create a syncrepl master that serves the "" base, and then set up >> a syncrepl consumer to pull down "dc=example,dc=com", which does *not* >> exist on the master, the replica will sit at 100% CPU, endlessly trying >> to add nothing. > > I'm not observing this with either re23 nor HEAD. The initial search > correctly fails with noSuchObject, and then both slapds sit at 0% CPU. > Can you give further details? I'll look at reproducing it again. In this particular case, the master had a database rooted at "", with some data around "cn=zimbra" contained in it. A replica was configured as a syncrepl client, but with "dc=example,dc=com" as its base, by mistake. This resulted in the CPU usage shooting to 100% on the replica, and the logs showing it trying to add without success. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5076) Spell checking man pages
by ghenry＠OpenLDAP.org 06 Aug '07

06 Aug '07

Full_Name: Gavin Henry Version: HEAD adn RE_23 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.229.93.1) Submitted by: ghenry Dear all, Just creating a ticket for CHANGES, as I'm running: aspell --lang=en_US -c on all our manpages in HEAD and RE_23. Will query if I haev any concerns. Gavin.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs