Hi list!

My master ldapserver is a FreeBSD 6.2-STABLE running OpenLDAP 2.3.38 the directory have ~ 5000 entries that are users from samba and qmail.

I experiencing a strange behavior with the search response time, here are two searches, one done with root dn and another with a user dn.

# time ldapsearch -D uid=user,ou=Users,dc=mydomain,dc=com,dc=br -b ou=Users,dc=mydomain,dc=com,dc=br -W -x > /dev/null Enter LDAP Password: 101.71s real 0.59s user 0.11s system

# time ldapsearch -D cn=root,dc=tempopar,dc=com,dc=br -b ou=Users,dc=mydomain,dc=com,dc=br -W -x > /dev/null Enter LDAP Password: 3.13s real 0.53s user 0.08s system

Follow my slapd.conf:

##################### # slapd.conf start #

include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/samba.schema include /usr/local/etc/openldap/schema/qmail.schema

pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args

#loglevel any #loglevel 160

sizelimit unlimited

# Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_hdb moduleload back_monitor moduleload smbk5pwd.so

# Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates limits dn.exact="cn=replicator,dc=mydomain,dc=com,dc=br" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #limits dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

access to attrs=sambaLogonTime by dn.exact="cn=logintimeupdator,dc=mydomain,dc=com,dc=br" write by * read

access to * by dn.exact="cn=replicator,dc=mydomain,dc=com,dc=br" read by dn.exact="cn=qmail-ldap,dc=mydomain,dc=com,dc=br" read by * none break

access to attrs=userPassword by self write by group.exact="cn=Sysadmins,dc=mydomain,dc=com,dc=br" write by * auth

access to attrs=shadowLastChange by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read

access to dn.regex="^(.*,)?ou=Computers,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read

access to dn.regex="^(.*,)?ou=Domains,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read

access to dn.regex="^(.*,)?ou=Idmap,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read

access to dn.regex="^(.*,)?ou=Users,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read

access to dn.regex="^(.*,)?ou=Groups,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read

access to dn.regex="^(.*,)?cn=SysAdmins,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write

#access to dn.regex="^(.+,)?uid=([^,]+),ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" #access to dn.regex="^(.+,)?ou=Users,dc=mydomain,dc=com,dc=br$" # by group.exact="cn=SysAdmins,ou=Groups,dc=mydomain,dc=com,dc=br" write # by * read

access to * by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by anonymous auth by * read

####################################################################### # # database definitions # #######################################################################

# # access log # database hdb

suffix cn=log

cachesize 10000 checkpoint 128 5

rootdn "cn=root,dc=mydomain,dc=com,dc=br"

directory "/var/db/openldap/cn=log/data"

index reqStart eq index reqDN pres,eq index reqAuthzID pres,eq

# # dc=mydomain,dc=com,dc=br #

database hdb

suffix "dc=mydomain,dc=com,dc=br"

cachesize 10000 checkpoint 128 5

rootdn "cn=root,dc=mydomain,dc=com,dc=br"

directory /var/db/openldap/dc=mydomain/data

# # Overlays # overlay smbk5pwd smbk5pwd-enable samba

overlay accesslog logdb cn=log logops writes logold (objectClass=posixAccount) logpurge 30+00:00 1+00:00

overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 200

# Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub index entryCSN,entryUUID eq index mailAlternateAddress pres,eq index mail pres,eq

database monitor

# # slapd.conf end #####################

Can my acl slowing the search too much ?? How can I improve then ?

Any help is very appreciated

Best Regards, Alexandre