--On Wednesday, August 07, 2019 10:35 AM +0000 alex.s(a)wildix.com wrote:
> Full_Name: Alex
> Version: 2.4.44+dfsg-5+deb9u2
Hello,
The ITS system is for bug reports, not usage questions. Additionally, if
you're doing replication of any type, please upgrade to the latest release
(2.4.48). Ensure you are using delta-syncrepl. For any other questions,
please use the correct forum which is the openldap-technical(a)openldap.org
mailing list:
<https://www.openldap.org/lists/mm/listinfo/openldap-technical>.
I believe there is a backport of 2.4.48 for Debian9 from the backports repo.
This ITS will be closed.
Regards,
Quanah
--
Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
Full_Name: Alex
Version: 2.4.44+dfsg-5+deb9u2
OS: Debian 9
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (154.41.3.130)
Hello
I have some issues with replication between Master and Slave LDAP servers.
Preconditions data:
I have a Master server with a huge LDAP data
And also I have about 200 Slave servers around the world which have a data
replica in their databases.
What happened:
I have applied a bckup on Master server. (Actually data have not changed except
entryCSN)
entryCSN has been deleted from backup previously, before apply, for actualise
data in LDAP database.
As a result I had a situation when all Slave servers starts replication.
The first question is: how I can avoid full replication after apply backup on
Master? I understand that entryCSN changed and LDAP should sync some objects.
But can I use another way to actualize the data in LDAP database instead of
entryCSN?
The second question is: after apply backup and restarts the Master server I had
a problem with local LDAP because all Slave servers start connecting and start
their replication. In this case LDAP on Master server not responding even on
localhost via ldapsearch. May I change some parameters to increase concurrent
connections? Because LDAP starts not responding if the quantity of simultaneous
connected of Slave servers exceeds 10-15
Thank you in advance
Best regards, Alex
> On 1. Aug 2019, at 19:47, Howard Chu <hyc(a)symas.com> wrote:
>=20
> vporof(a)mozilla.com wrote:
>> Hey folks.
>>=20
>> =3D46rom Myk=3DE2=3D80=3D99s investigations in the previous followup, =
it seems =3D
>> that the suggested changes to `mdb_cursor_init` to avoid using an =3D
>> invalid DBI might not be solving the actual issue, given the =
behaviour =3D
>> of `mdb_page_search`.
>=20
> Agreed, that assert that I suggested isn't catching what we want.
FWIW, here's my findings when attempting to look into what was happening =
with regards to that test case: =
https://gist.github.com/victorporof/d1f98b8a52f79c7ff99f361d3a2adc3e
It's unclear how much overlap there is with the previous findings, and =
whether or not calling `mdb_put` should assert with the DBI previously =
opened via `mdb_dbi_open` with MDB_CREATE. Let me know if what I'm =
observing here is expected.
>=20
>> It=3DE2=3D80=3D99s also causing the seemingly correct test program to =
assert =3D
>> when it wasn=3DE2=3D80=3D99t before. It=3DE2=3D80=3D99s unclear =
whether this should =3D
>> be the case or not, perhaps Howard can confirm the expected =
behaviour.
>>=20
>> In any case, we=3DE2=3D80=3D99re wondering if there=3DE2=3D80=3D99s =
been any other =3D
>> progress, or if someone managed to reproduce this issue? Shipping new =
=3D
>> features built on top of LMDB in Firefox is currently blocked due to =
=3D
>> these failures, so any additional info would be helpful.
>=20
> Sorry, still not seeing this over here. What else do you know about =
the
> systems where this is occurring? RAM size, storage on HDD / SSD / USB =
?
Here's everything we know about: =
https://crash-stats.mozilla.org/report/index/5d77bd19-41ce-459f-9c1c-7f9fb=
0190324 See the "details" and "telemetry environment" sections for a =
breakdown.
Victor
>=20
> --=20
> -- Howard Chu
> CTO, Symas Corp. http://www.symas.com
> Director, Highland Sun http://highlandsun.com/hyc/
> Chief Architect, OpenLDAP http://www.openldap.org/project/
vporof(a)mozilla.com wrote:
> Hey folks.
>
> =46rom Myk=E2=80=99s investigations in the previous followup, it seems =
> that the suggested changes to `mdb_cursor_init` to avoid using an =
> invalid DBI might not be solving the actual issue, given the behaviour =
> of `mdb_page_search`.
Agreed, that assert that I suggested isn't catching what we want.
> It=E2=80=99s also causing the seemingly correct test program to assert =
> when it wasn=E2=80=99t before. It=E2=80=99s unclear whether this should =
> be the case or not, perhaps Howard can confirm the expected behaviour.
>
> In any case, we=E2=80=99re wondering if there=E2=80=99s been any other =
> progress, or if someone managed to reproduce this issue? Shipping new =
> features built on top of LMDB in Firefox is currently blocked due to =
> these failures, so any additional info would be helpful.
Sorry, still not seeing this over here. What else do you know about the
systems where this is occurring? RAM size, storage on HDD / SSD / USB ?
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
--On Thursday, August 01, 2019 4:16 PM +0000 quanah(a)openldap.org wrote:
> Full_Name: Quanah Gibson-Mount
> Version: 2.4.47
> OS: N/A
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (47.208.128.44)
>
>
> In investigating why a particular consumer went into REFRESH mode, I find
> that this was triggered by one of its providers currently parsing a
> sessionlog. Sessionlog parsing should *not* cause a consumer of that
> server to fall back to REFRESH.
Some notes on this specific environment and situation.
This is a 4-way MMR setup. Via the use of a load balancer, only
iam-ed-ldp-p01 recieves write operations. Thus there should never be any
REFRESHes occurring anywhere, so the fact that there is is already
problematic.
Servers are p01, p02, p03 (all in the same data center) and b01 (offsite DR
system).
At the time this issue hit:
p01 was upgraded to a new release of OpenLDAP @ 21:26:48, thus we see:
Jul 30 21:25:17 iam-ed-ldp-p01 slapd[30495]: slapd shutdown: waiting for 0
operations/tasks to finish
Jul 30 21:26:48 iam-ed-ldp-p01 slapd[20978]: @(#) $OpenLDAP: slapd 2.4.47
(Mar 22 2019 09:12:20)
$#012#011build@rhel7build.rb.symas.net:/home/build/sold-2.4.47.3/redhat7-x86_64/build/openldap.x86_64/servers/slapd
Jul 30 21:26:48 iam-ed-ldp-p01 slapd[20979]: slapd starting
Jul 30 21:26:48 iam-ed-ldp-p01 slapd[20979]: do_syncrep2: rid=002
LDAP_RES_INTERMEDIATE - REFRESH_DELETE
Jul 30 21:26:48 iam-ed-ldp-p01 slapd[20979]: do_syncrep2: rid=001
LDAP_RES_SEARCH_RESULT
Jul 30 21:26:48 iam-ed-ldp-p01 slapd[20979]: do_syncrep2: rid=001
delta-sync lost sync, switching to REFRESH
Jul 30 21:26:48 iam-ed-ldp-p01 slapd[20979]: do_syncrep2: rid=001 (4096)
Content Sync Refresh Required
Jul 30 21:26:48 iam-ed-ldp-p01 slapd[20979]: do_syncrep2: rid=003
LDAP_RES_INTERMEDIATE - REFRESH_DELETE
p03 was operating w/o issue. Interstingly enough, when it was restarted
for the software update @ 21:37:16, it got an error (53) talking to p02
instead of an error (4096) like p01 did. This is likely because p02 was
restarted for its software update @ 21:32:19, which wiped out its
sessionlog.
p02 had started doing session log parsing @ 21:26:17 with
Jul 30 21:26:17 iam-ed-ldp-p02 slapd[3750]: conn=18205759 op=1 SEARCH
RESULT tag=101 err=4096 duration=18.462ms nentries=0 text=sync cookie is
stale
We see the connection to p02 from p01 with a similar issue when it starts
up:
Jul 30 21:26:48 iam-ed-ldp-p02 slapd[3750]: conn=18205790 op=1 SRCH
base="cn=accesslog" scope=2 deref=0
filter="(&(objectClass=auditWriteObject)(reqResult=0))"
Jul 30 21:26:48 iam-ed-ldp-p02 slapd[3750]: conn=18205790 op=1 SRCH
attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN
Jul 30 21:26:48 iam-ed-ldp-p02 slapd[3750]: conn=18205790 op=1 SEARCH
RESULT tag=101 err=4096 duration=0.431ms nentries=0 text=sync cookie is
stale
b01 had its software update @ 21:21:25
Generally it seems like restarting/wiping the sessionlog made things
incredibly bad across the cluster.
--
Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
On Wed, Jul 31, 2019 at 11:02:55AM -0400, Greg Veldman wrote:
> On Wed, Jul 31, 2019 at 03:25:21PM +0100, Howard Chu wrote:
> > I've been looking for a way to support the hashing callbacks. Without them,
> > this won't be accepted.
> >
> > Easiest at this point is simply to define a character (maybe space, or tab)
> > as a delimiter between seed and password.
>
> Thanks Howard. I was trying to stay away from that as it would
> make it somewhat confusing to use that character, but if you
> think it's OK to implement that way I'll give it a shot. I'll
> just make sure it's well documented in the manpage as well...
v3 of the patch is available, which includes hashing functions
and documents the expected input format when using those functions.
I don't have the updated module on any of my servers yet, but
running slappasswd from my build directory does seem to yield
the same results as the non-password versions:
$ ../../../../servers/slapd/slappasswd -T passwd -o module-load=`pwd`/.libs/pw-totp.so -h "{TOTP1}"
New password:
Re-enter new password:
{TOTP1}GAYA====
$ ../../../../servers/slapd/slappasswd -T passwd -o module-load=`pwd`/.libs/pw-totp.so -h "{TOTP1ANDPW}"
New password:
Re-enter new password:
{TOTP1ANDPW}GAYA====|{SSHA}Qo6WiIWWsWohlwZSo9oQkImKvSNArGio
This is using an OTP seed of 00 and a password of foo
https://scinet.supercomputing.org/~gv/slapd-totp-v3.txt
--
Greg Veldman