Hi, I am also adding the guide to replicate the error as plain text:=20 Step-by-step guide The following guide was created on an Ubuntu Linux V. 14.04.3 LTS, but = it should be executeable on an Debian based Linux operating systems. You = should be logged in as root user or adopt all commands with sudo. 1. Add hostname echo 'ldap-debug.example.com' > /etc/hostname && hostname `cat = /etc/hostname` && hostname echo '52.49.174.211 ldap-debug.example.com ldap-debug' >> /etc/hosts 2. Download latest Sources wget = http://www.openldap.org/software/download/OpenLDAP/openldap-release/openld= ap-2.4.44.tgz 3. Validate Sources(compare md5 provided on website with generated md5 = hash) md5sum openldap-2.4.44.tgz 4. Make archive executable and extract sources and change into = extracted directory chmod +x openldap-2.4.44.tgz && tar xzf openldap-2.4.44.tgz && cd = openldap-2.4.44 5. Fullfil most important software requirements (Dependencies) apt-get update apt-get install libdb-dev apt-get install openssl apt-get install gnutls-bin apt-get install gcc apt-get install make 6. Run configure with default settings and add a target dir only ./configure --prefix=3D/usr/local/openldap 7. Run make and install sources to target directory make depend make make test make install 8. Stop the daemon, because slapd was already started by make. pkill slapd 9. Edit main config file in /usr/local/openldap/etc/openldap/slapd.conf = and add the following lines: include /usr/local/openldap/etc/openldap/schema/core.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args modulepath /usr/lib/ldap moduleload back_hdb backend hdb database hdb suffix "dc=3Dexample,dc=3Dcom" rootdn "cn=3DManager,dc=3Dexample,dc=3Dcom" rootpw secret directory /var/lib/ldap index objectClass eq 10. Call slappasswd and set rootpw to secret slappasswd 11. Create data directory for hdb files mkdir /var/lib/ldap 12. We will add a symbolic link to ease slapd commands ln -s /usr/local/openldap/libexec/slapd /usr/local/bin/slapd 13. Add the path to OpenLDAP bin and sbin dirs and activate the new path echo "export = PATH=3D\$PATH:/usr/local/openldap/bin/:/usr/local/openldap/sbin/" >> = /root/.bashrc && source /root/.bashrc 14. Start the slapd daemon with -f flag for location of the config file slapd -f /usr/local/openldap/etc/openldap/slapd.conf 15. Create initial DIT file with an editor of your choice, i.e. vi = /root/create_dit.ldif and copy paste the following lines into this file. dn: dc=3Dexample,dc=3Dcom changetype: add objectClass: dcObject objectClass: organization objectClass: top dc: example o: example.com =20 dn: ou=3DProjects,dc=3Dexample,dc=3Dcom changetype: add ou: Projects objectClass: organizationalUnit =20 dn: ou=3DTrash,dc=3Dexample,dc=3Dcom changetype: add ou: Trash objectClass: organizationalUnit =20 dn: ou=3Dtest1,ou=3DProjects,dc=3Dexample,dc=3Dcom changetype: add ou: test1 objectClass: organizationalUnit =20 dn: ou=3Dtest2,ou=3Dtest1,ou=3DProjects,dc=3Dexample,dc=3Dcom changetype: add ou: test2 objectClass: organizationalUnit 16. Add the initial DIT ldapadd -H 'ldap://localhost' -D 'cn=3DManager,dc=3Dexample,dc=3Dcom' = -w secret -f /root/create_dit.ldif 17. Execute modrdn and assign directory Trash as a new superior of test1 = directory ldapmodrdn -x -w secret -D "cn=3DManager,dc=3Dexample,dc=3Dcom" -s = "ou=3DTrash,dc=3Dexample,dc=3Dcom" -r = "ou=3Dtest1,ou=3DProjects,dc=3Dexample,dc=3Dcom" "ou=3Dtest1" 18. Execute following ldapsearch and save the result somewhere for i in {,{,{,ou=3Dtest2\,}ou=3Dtest1\,}ou=3DTrash\,}dc=3Dexample,dc=3D= com; do echo -e "\n=3D=3D=3D=3D=3D> basedn: $i <=3D=3D=3D=3D=3D\n"; = ldapsearch -LLL -s 'sub' -H 'ldap://localhost:389' -D = 'cn=3DManager,dc=3Dexample,dc=3Dcom' -w secret -b "$i" '(ou=3Dtest*)' = dn; done Result: =3D=3D=3D=3D=3D> basedn: dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D=3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: ou=3DTrash,dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D= =3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom = <=3D=3D=3D=3D=3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: = ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D=3D dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom 19. We see until here everything is working as expected, but now we will = enable cache and idlcache as recommended in OpenLDAP docs and = Performance Guides and problems will appear soon. echo -e "cachesize\t10000\nidlcachesize\t30000" >> = /usr/local/openldap/etc/openldap/slapd.conf 20. Remove existing DIT ldapdelete -H 'ldap://localhost' -D 'cn=3DManager,dc=3Dexample,dc=3Dco= m' -w secret -r "dc=3Dexample,dc=3Dcom" -v 21. Restart daemon and recreate initial DIT pkill slapd slapd -f /usr/local/openldap/etc/openldap/slapd.conf ldapadd -H 'ldap://localhost' -D 'cn=3DManager,dc=3Dexample,dc=3Dcom' = -w secret -f /root/create_dit.ldif 22. Execute modrdn ldapmodrdn -x -w secret -D "cn=3DManager,dc=3Dexample,dc=3Dcom" -s = "ou=3DTrash,dc=3Dexample,dc=3Dcom" -r = "ou=3Dtest1,ou=3DProjects,dc=3Dexample,dc=3Dcom" "ou=3Dtest1" 23. Check result again with ldapsearch for i in {,{,{,ou=3Dtest2\,}ou=3Dtest1\,}ou=3DTrash\,}dc=3Dexample,dc=3D= com; do echo -e "\n=3D=3D=3D=3D=3D> basedn: $i <=3D=3D=3D=3D=3D\n"; = ldapsearch -LLL -s 'sub' -H 'ldap://localhost:389' -D = 'cn=3DManager,dc=3Dexample,dc=3Dcom' -w secret -b "$i" '(ou=3Dtest*)' = dn; done Result: =3D=3D=3D=3D=3D> basedn: dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D=3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: ou=3DTrash,dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D= =3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom = <=3D=3D=3D=3D=3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: = ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D=3D dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom 24. Once again the result was fine and as expected. Keep in mind cache = and idlcache were empty as we've restarted the daemon. Now we are = performing same actions again while we have cached results. 25. Remove directories in ou =E2=80=9ETrash=E2=80=9C ldapdelete -w secret -D "cn=3DManager,dc=3Dexample,dc=3Dcom" -r = "ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom" 26. Add directories to ou =E2=80=9EProjects=E2=80=9C again ldapmodify -D "cn=3DManager,dc=3Dexample,dc=3Dcom" -W Type in password Enter LDAP Password: Copy paste following ldif and be sure emtpy lines are copied, too! dn: ou=3Dtest1,ou=3DProjects,dc=3Dexample,dc=3Dcom changetype: add objectClass: organizationalUnit =20 dn: ou=3Dtest2,ou=3Dtest1,ou=3DProjects,dc=3Dexample,dc=3Dcom changetype: add objectClass: organizationalUnit 27. Now we have same DIT structure again and can rerun modrdn command ldapmodrdn -x -w secret -D "cn=3DManager,dc=3Dexample,dc=3Dcom" -s = "ou=3DTrash,dc=3Dexample,dc=3Dcom" -r = "ou=3Dtest1,ou=3DProjects,dc=3Dexample,dc=3Dcom" "ou=3Dtest1" 28. If we now check result with ldapsearch again the idlcache error will = appear for i in {,{,{,ou=3Dtest2\,}ou=3Dtest1\,}ou=3DTrash\,}dc=3Dexample,dc=3D= com; do echo -e "\n=3D=3D=3D=3D=3D> basedn: $i <=3D=3D=3D=3D=3D\n"; = ldapsearch -LLL -s 'sub' -H 'ldap://localhost:389' -D = 'cn=3DManager,dc=3Dexample,dc=3Dcom' -w secret -b "$i" '(ou=3Dtest*)' = dn; done Result: =3D=3D=3D=3D=3D> basedn: dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D=3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: ou=3DTrash,dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D= =3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom = <=3D=3D=3D=3D=3D dn: ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom =3D=3D=3D=3D=3D> basedn: = ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom <=3D=3D=3D=3D=3D dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3Dcom 29. The search result of basedn: ou=3DTrash,dc=3Dexample,dc=3Dcom is = wrong! The line of dn: ou=3Dtest2,ou=3Dtest1,ou=3DTrash,dc=3Dexample,dc=3D= com is missing within the resultset. 30. After a restart of the daemon the missing line will appear again. = Actually the one and only solution is to switch of idlcachesize and set = it explicitely to "0" LTS server. after is still as soon as until slapd available via