openldap-software

openldap-software@openldap.org

2719 discussions

Re: OpenLDAP Backup Questions
by Howard Chu 07 Feb '07

07 Feb '07

Please keep replies on the list. Discussions that start on the public mailing list should stay on the list so that everyone can see their resolution. Rajarshi Chaudhuri wrote: > Thanks Howard. > > One question - if slapcat is backing up the data - and meanwhile some > writes are happening to ldap data (as slapd is running) - then what > would happen to the backup ldif file - it will get all the data until > some cut-off point - or even the current updates will also go into it? slapcat reads the database sequentially. If an entry that has already been dumped gets updated, then that update obviously won't appear in the dump. If an entry is updated before slapcat reaches it, then the updated entry will appear in the dump. > Can there be any inconsistency if there are two many writes going on > during the backup time? What kind of inconsistency? Writes to the DB are atomic, so it's impossible for slapcat to see an entry in an in-between state, no matter how many writes are occurring. The only possible inconsistency is as noted above - changes made to entries that were already read out won't be seen until the next time you do a backup. > > Regds, > Rajarshi Chaudhuri > Genesys Telecommunications Lab, Inc > rajarshi(a)genesyslab.com > > -----Original Message----- > From: Howard Chu [mailto:hyc@symas.com] > Sent: Wednesday, February 07, 2007 3:42 PM > To: Rajarshi Chaudhuri > Cc: openldap-software(a)openldap.org > Subject: Re: OpenLDAP Backup Questions > > Rajarshi Chaudhuri wrote: >> Hi, >> >> >> I'm planning to make a daily backup of my openldap(2.3.19 used with > bdb >> backend). There are couple of questions that I have - >> >> 1. If I take a backup using slapcat while slapd is running - is there > a >> possibility of some data loss or other inconsistency? > > No. > >> 2. Is there some other effective backup mechanism / backup tool >> recommended other >> than slapcat. > > No. >> 3. If I can programmatically assure that no writes happen during my > backup >> phase - then does it matter whether slapd is running or not? > > No. >> 4. I'm going to do this in both Windows and Solaris environment - so > any >> suggestions like I should use something specific based on the OS? > > No. >> I would highly appreciate if my questions are effectively answered. >> >> >> >> Rajarshi Chaudhuri >> Genesys Telecommunications Lab, Inc >> rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com> -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

RE: OpenLDAP Backup Questions
by Quanah Gibson-Mount 07 Feb '07

07 Feb '07

--On Wednesday, February 07, 2007 3:50 PM -0800 Rajarshi Chaudhuri <rajarshi(a)genesyslab.com> wrote: > Hi Quanah - > > Sorry for re-posting. As you mentioned - Please keep replies on the list. > <<< You should address your questions to openldap-software(a)openldap.org > when > they have to do with using OpenLDAP. >>> > > So - I thought I need to post it there too for archival purpose. > > So - as per your suggestion I should be OK taking hot backups using > slapcat keeping slapd running. You also suggested to upgrade the version > - I see the new version is 2.3.33 - is it the recommended one or some > prior one should be better? See the page on <http://www.openldap.org> about the difference between "stable" and "current". You may also want to read over the change log of what was fixed between releases, which is distributed with each release, and also available from the website. > Further questions for you (forgive me - I'm new to this openldap stuff). > Is there a way to instruct slapd to do a recovery first each time it is > re-started? Also - is the graceful/gentle shutdown of slapd reliable? > Can you point me a location where there are good sample scripts > demonstrating these things - like backup/recovery etc. OpenLDAP 2.3 already performs recovery on startup, if it is necessary. There has been no evidence that graceful/gentle shutdown of slapd is unreliable. I personally turned it off because if you have persistent connections that never close, slapd will never shutdown. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

OpenLDAP Backup Questions
by Rajarshi Chaudhuri 07 Feb '07

07 Feb '07

Hi, I'm planning to make a daily backup of my openldap(2.3.19 used with bdb backend). There are couple of questions that I have - 1. If I take a backup using slapcat while slapd is running - is there a possibility of some data loss or other inconsistency? 2. Is there some other effective backup mechanism / backup tool recommended other than slapcat. 3. If I can programmatically assure that no writes happen during my backup phase - then does it matter whether slapd is running or not? 4. I'm going to do this in both Windows and Solaris environment - so any suggestions like I should use something specific based on the OS? I would highly appreciate if my questions are effectively answered. Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com>

3 2

Invalid DN
by Ian Moroney 07 Feb '07

07 Feb '07

Hi again all! Just another brick wall i've ran into... I am running the following command: ldapadd -x -h localhost -D cn=mailadmin,dc=global-drum,dc=com -W -f /srv/ox/share/init_ldap.ldif I then get: ldap_bind: Invalid DN syntax (34) additional info: invalid DN This error happens if i have UID=mailadmin,dc=global-drum,dc=com, cn=root.... cn=mailadmin or whatever. if necessary, i can post the contents of the init_ldap.ldif and my slapd.conf files. ldapsearch -h localhost -D "UID=mailadmin,dc=global-drum,dc=com" -x -W (after password enter) comes back with: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 and when i look at slapd -d -1, it is showing the following, amongst other things: ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 ber_get_next: tag 0x39 len 5 contents: ber_dump: buf=0x80268b80 ptr=0x80268b80 end=0x80268b85 len=5 0000: 02 01 03 42 00 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable ber_get_next on fd 16 failed errno=11 (Resource temporarily unavailable) The database is supposed to be empty, so maybe it should be reporting what it is reporting above. Thoughts? Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk <http://www.techdivision.co.uk/> TechDivision - Making IT Work

3 2

slapd segfault when using pcache
by Fabio Pedretti 07 Feb '07

07 Feb '07

Hi, I am trying to use slapd as a proxycache LDAP daemon for another LDAP server. (I was following the manual here: http://www.openldap.org/doc/admin23/proxycache.html but this refers to proxycache, which I think it is now replaced by pcache? Should the manual be updated?) This is my slapd.conf: include /usr/local/etc/openldap/schema/core.schema pidfile /var/ldap/slapd.pid argsfile /var/ldap/slapd.args database ldap suffix "o=example,c=COM" rootdn "uid=root,o=example,c=COM" uri "ldap://ldap1.example.com ldap://ldap2.example.com" overlay pcache proxycache ldbm 10000 1 1000 3600 directory /var/ldap/openldap-data cachesize 100 index objectClass eq index uid eq index uidNumber eq index gidNumber eq When I run slapd with -d 1 I get this: ... slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=include{0}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}ldap" config_build_entry: "olcOverlay={0}pcache" backend_startup_one: starting "o=example,c=COM" ldap_back_db_open: URI=ldap://ldap1.example.com ldap://ldap2.example.com backend_startup_one: starting "o=example,c=COM" ldbm_back_db_open: unclean shutdown detected; database may be inconsistent! slapd starting ../rc.d/rc.slapd: line 15: 22613 Segmentation fault $SLAPD -u $USER -h "$LDAPSOCKET" -d 1 If I add this to slapd.conf: proxyattrset 0 pager slapd no longer crashes, but does not start. I get this now: ... bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) >>> dnPrettyNormal: <o=example,c=COM> <<< dnPrettyNormal: <o=example,c=COM>, <o=example,c=com> >>> dnPrettyNormal: <uid=root,o=example,c=COM> <<< dnPrettyNormal: <uid=root,o=example,c=COM>, <uid=root,o=example,c=com> ldap_url_parse_ext(ldap://ldap2.example.com) ldap_url_parse_ext(ldap://ldap1.example.com) slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Any ideas on what's wrong? Thanks in advance, Fabio

3 6

Re: syncrepl issues
by Wes Rogers 07 Feb '07

07 Feb '07

> Given that no problems show up in 2.3.27, and looking at the diffs between > 2.3.27 and 2.3.32, the only substantive difference is in syncprov_checkpoint > handling, due to ITS#4720. Looking over that patch, it's possible the chosen > fix was bad. > > Try turning off syncprov-checkpoint in your provider. If that makes a > difference, then the ITS#4720 patch is broken. So far, that hasn't made a difference. The two problem consumers still do the same thing. These particular consumers are in a different network, and are heavily firewalled. I brought up a test consumer on the same network as the provider, and it stays in sync 100%. So, I'll need to poke the network to see what I can find. Thank you both for the help so far. Wes

1 0

RE: logging
by Ian Moroney 07 Feb '07

07 Feb '07

Thanks for all the replies guys, looked at the output of slapd -d -1 and it showed that there was an invalid ACCESS statement in my slapd.conf Removed it, and it starts ok now. BTW, I don't appear to have any syslog.conf on the system, but syslog-ng is installed, so I put the LOCAL4.* statement into my syslog-ng.conf.in file, so hopefully that should work now. Thanks for all your replies! Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk TechDivision - Making IT Work -----Original Message----- From: openldap-software-bounces+ian.moroney=techdivision.co.uk(a)OpenLDAP.org [mailto:openldap-software-bounces+ian.moroney=techdivision.co.uk@OpenLDA P.org] On Behalf Of Gavin Henry Sent: 06 February 2007 22:51 To: Ian Moroney Cc: openldap-software(a)openldap.org Subject: Re: logging <quote who="Ian Moroney"> > Hi guys. How can i set up logging for openldap so i can find out why > the damn thing won't start? :P i've got the good old ldap_bind: can't > contact LDAP server (-1) problem... and i'd like to look at a log file > to see what is causing the problem I know how to set the loglevel to > 256 in the configuration file, but no idea what file to look at for > the output. > Help! :D > Add to your syslog.conf: LOCAL4.* -/var/log/openldap.log etc. and restart slapd and syslog See: http://www.openldap.org/faq/data/cache/80.html -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

ldapsearch error for SASL (DIGEST-MD5)
by Radhakrishnan Balasubramanian 06 Feb '07

06 Feb '07

Hi, When I do ldapsearch for digest-md5 from the linux computer to my Openldap server, I am getting the output like below: [tester@bf1r-oLinux-1 tester]$ ldapsearch -H ldap://192.168.0.18 -U pokemon -w pokemon123 SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: More results to return Is there anyway to get the proper output for ldapsearch using digest-md5 ? I do not have this issue when I do ldapsearch on the localhost. Please help. Thanks, Radhakrishnan ____________________________________________________________________________________ Looking for earth-friendly autos? Browse Top Cars by "Green Rating" at Yahoo! Autos' Green Center. http://autos.yahoo.com/green_center/

1 0

syncrepl issues
by Wes Rogers 06 Feb '07

06 Feb '07

I have never had any problems up until now with syncrepl. 1 consumer is always in sync, yet the 2 newer ones start out in sync but after about 10 minutes they don't sync at all. It is always fixed by restarting slapd on the 2 problem consumers. Various debugging and tcpdumps just confirm that it isn't staying in sync but nothing as far as errors. This same configuration is running on another instance (although openldap 2.3.27, db-4.4.20) with 1 provider and 9 consumers without any issues. Configuration : 1 provider 3 consumers All are openldap-2.3.32 with db-4.4.20 plus the 4 patches. provider config : database monitor access to dn.subtree=cn=monitor by dn.exact=cn=Manager,dc=company,dc=com write by dn.subtree=dc=company,dc=com read by * none access to dn="" by * read access to attrs=userPassword by self write by dn="cn=Manager,dc=company,dc=com" write by anonymous auth by * none access to * by self write by dn="cn=Manager,dc=company,dc=com" write by * none access to attrs=userPassword by self write by anonymous auth by dn.base="cn=dcAuth,ou=Applications,ou=Prod,ou=Project,dc=company,dc=com" write by * none access to * by self write by dn.base="cn=dcAuth,ou=Applications,ou=Prod,ou=Project,dc=company,dc=com" write by * read access to * by dn="cn=replicator,ou=Service,ou=Applications,ou=Prod,ou=Project,dc=company,dc=com" write by * read database bdb suffix "dc=company,dc=com" overlay ppolicy ppolicy_default "cn=dc,ou=Policies,dc=company,dc=com" rootdn "cn=Manager,dc=company,dc=com" rootpw {crypt}asdf directory /blah/openldap/var/openldap-data overlay syncprov syncprov-checkpoint 10 60 syncprov-sessionlog 500 # Indices to maintain for this database index objectClass eq,pres index sudoUser eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index entryUUID eq index entryCSN eq consumer config (same on all 3, except for rid) database monitor access to dn.subtree=cn=monitor by dn.exact=cn=Manager,dc=company,dc=com write by dn.subtree=dc=company,dc=com read by * none access to dn="" by * read access to attrs=userPassword by self write by dn="cn=Manager,dc=company,dc=com" write by anonymous auth by * none access to * by self write by dn="cn=Manager,dc=company,dc=com" write by * none access to attrs=userPassword by self write by anonymous auth by dn.base="cn=dcAuth,ou=Applications,ou=Prod,ou=Project,dc=company,dc=com" write by * none access to * by self write by dn.base="cn=dcAuth,ou=Applications,ou=Prod,ou=Project,dc=company,dc=com" write by * read access to * by dn="cn=replicator,ou=Service,ou=Applications,ou=Prod,ou=Project,dc=company,dc=com" write by * read database bdb suffix "dc=company,dc=com" overlay ppolicy ppolicy_default "cn=dc,ou=Policies,dc=company,dc=com" rootdn "cn=Manager,dc=company,dc=com" rootpw {crypt}adsf directory /blah/openldap/var/openldap-data # Indices to maintain for this database index objectClass eq,pres index sudoUser eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index entryUUID eq syncrepl rid=2 provider=ldaps://10.0.0.1 type=refreshAndPersist retry=60,10,300,3 searchbase="dc=company,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,ou=Service,ou=Applications,ou=Prod,ou=Project,dc=company,dc=com" credentials=adsf

3 2

Re: slapd crashing "randomly?"
by Daniel Henninger 06 Feb '07

06 Feb '07

On Feb 6, 2007, at 1:39 PM, mikee wrote: > On Tue, 06 Feb 2007, matthew sporleder might have said: > >> On 2/6/07, daniel(a)ncsu.edu <daniel(a)ncsu.edu> wrote: >>> Hi folk, >>> >>> I want to start this message by saying, what I'm about to >>> describe is >>> completely vague and I don't expect to get a solution response. ;) >>> Basically, I'm out of ideas and am looking for some suggestions >>> as to how >>> to debug the issue I'm running into. >>> >>> Starting about half a year ago, slapd started "just dieing" out >>> of the >>> blue. Not a think in the logs shows up to indicate what might >>> have caused >>> it. The last query that I see in the logs before a crash always >>> seems to >>> be nothing special. I don't even see a core dump being generated >>> yet, but >>> then that may just be because I don't have the proper setup to >>> get a core >>> dump at this time. We were running the last 2.2 and upgraded to the >>> latest release of 2.3 to make sure it wasn't an "old version" issue. >>> Unfortunately, slapd still dies a fair amount on us. It appears >>> to be >>> fairly unpredictable. I've seen it crash within 1 minute of >>> starting up >>> slapd (then a subsequent startup 'takes' just fine). I've seen >>> it crash >>> when there were a number of network issues going on. I've seen >>> it crash >>> out of the blue when nothing appeared to be going on. I don't >>> really have >>> the drive space to turn on max debug logging 24/7 until the problem >>> occurs. >>> >>> We're thinking about setting up something to watch all of the >>> network >>> traffic going to one of the boxes until it dies. (assuming we >>> can find >>> something with the resources to do that) >>> >>> That all said... since I have nothing solid to present, do you >>> all have >>> any suggestions of what would be the best way to track down >>> what's going >>> on? I'm literally out of ideas unless my berkeley db config is >>> somehow >>> causing the problem or something like that. >>> >>> I apologize for the vagueness. =/ Any ideas/suggestions? >>> >> >> >> After the crash, is your bdb environment clean, or is it needing a >> db_recover? >> Depending on your OS, you could watch the pid all the time and trap >> the last signals received, last files accessed, etc, and that >> wouldn't >> take tons of resources. >> >> You could try turning on max debugging and simply rotate a lot more >> often. (every n minutes or even seconds) This way you could >> definitely keep the -last- transactions and just not worry about the >> old ones. >> > > What about running a continous 'strace -p 99999' of slapd and wait for > it to die again. The strace window should show the last call to the > kernel. Hrm. Good point, I could probably run that inside of screen or something. I'll give that a whirl, thanks! Daniel > > Mike

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software