donn@u.washington.edu wrote:

On Aug 10, 2007, at 1:53 PM, Howard Chu wrote:

...

You didn't mention how your syncrepl is configured but it seems that this can only occur for refreshAndPersist mode, with old entries being ldapadd'd to the running master.

It is indeed refreshAndPersist ...

...

In fact, since entryCSN is NO-USER-MODIFICATION it shouldn't even be possible to add entries this way to a running server. Before we can "catch the problem in the master" we need more information on how the problem was caused.

The master server had updatedn defined to itself. Changes, logged from another server, were applied with ldapmodify.

"Don't do this" ... You're essentially creating the same inconsistency that a naive multimaster setup introduces. Since 2.4.4 has real multimaster support, you should not be doing things this way.

Note that a proper configuration works with either refreshOnly or refreshAndPersist mode, and cascaded to an arbitrary depth. Your current setup only works with refreshAndPersist, and cannot be cascaded reliably. I.e. your setup is inherently broken.