openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Re: Slow to add 1 million items
by Andrew Eross 07 Feb '14

07 Feb '14

Hi Quanah, Ubuntu 10.04 LTS Linux 2.6.32-43-generic-pae #97-Ubuntu SMP Wed Sep 5 16:59:17 UTC 2012 i686 GNU/Linux The latest OpenLDAP 2.4.39 All of those tests done with the mdb backend, of course, and the actual file system is ext4 It's a fairly stock 10.04 system, no special config/kernel changes. Cheers, Andrew Andrew Eross CTO Locatrix Communications Office: +61 7 3123 1469 Mobile: +55 37 9858 9815 eross(a)locatrix.com On Wed, Feb 5, 2014 at 1:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, February 04, 2014 6:52 PM -0200 Andrew Eross < > eross(a)locatrix.com> wrote: > > >> >> Thanks, Dieter, Quanah. >> >> >> I've been doing some experimenting with those mdb options. >> >> >> I ran a few tests with inserting 10,000 records, wiping the DB in >> between, and changing just the one option at a time: >> >> >> Base-line, no extra options: 4m8sWith "writemap" enabled: 8m55s >> >> With "writemap+mapasync" enabled: 5m12s >> With "dbnosync+checkpoint 0kb/1min": 0m14s >> > > I know you answered some of this before, but please update with: > > What kernel? > What OpenLDAP version? > What Ubuntu release? > What filesystem for the LDAP DB? > > Thanks, > > Quanah > > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

5 7

RE: Antw: RE: Syncrepl and mmr
by Ulrich Windl 06 Feb '14

06 Feb '14

Hi! (People will flame me because of this, but...) I'd suggest to start completely new with a clean standard distribution. Once your configuration works, you can update your software and change configuration until it stops working. ;-) Regards, Ulrich >>> "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> schrieb am 06.02.2014 um 17:47 in Nachricht <20140206164804.ECB0F44E78(a)rrzmta2.uni-regensburg.de>: > All, > > I came in this morning, and the test environment was hung. Not sure what is > going on. slapd on both servers will not stay up for more than 5-minutes. I > tried to back step so attempted to slapadd from the dbase.ldif that I created > the other day when things were working. When slapadding, I am receiving the > following error: > # slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l > /usr/local/openldap/etc/openldap/ldif/backup/mm-server2_example_ldap.ldif > 52f3bb11 olcDbDirectory: value #0: invalid path: No such file or directory > 52f3bb11 config error processing olcDatabase={1}bdb,cn=config: > olcDbDirectory: value #0: invalid path: No such file or directory > slapadd: bad configuration directory! > > Any assistance as to what to look for would be great! > > Thanks in advance > John > > ________________________________________ > From: Ulrich Windl [Ulrich.Windl(a)rz.uni-regensburg.de] > Sent: Wednesday, February 05, 2014 2:50 AM > To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org; Quanah > Gibson-Mount > Subject: Antw: RE: Syncrepl and mmr > > "52f0fe5f send_search_entry: conn 1003 access to attribute userPassword, > value #0 not allowed" > > I'm not surprised that you have a problem with the user's password. > >>>> "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> schrieb am > 04.02.2014 um 15:56 in Nachricht > <201402041456.s14EuaHc022629(a)boole.openldap.org>: >> Here is a log snippet from mm-server2: >> >> 52f0fe5f => slap_access_allowed: read access granted by read(=rscxd) >> 52f0fe5f => access_allowed: read access granted by read(=rscxd) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result was in cache (objectClass) >> 52f0fe5f => access_allowed: result not in cache (userPassword) >> 52f0fe5f => access_allowed: read access to >> "uid=jdoe,ou=Users,dc=example,dc=ldap" "userPassword" requested >> 52f0fe5f => acl_get: [1] attr userPassword >> 52f0fe5f => acl_mask: access to entry "uid=jdoe,ou=Users,dc=example,dc=ldap", >> attr "userPassword" requested >> 52f0fe5f => acl_mask: to value by "cn=admin,cn=config", (=0) >> 52f0fe5f <= check a_dn_pat: self >> 52f0fe5f <= check a_dn_pat: anonymous >> 52f0fe5f <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap >> 52f0fe5f <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap >> 52f0fe5f <= check a_dn_pat: * >> 52f0fe5f <= acl_mask: [5] applying none(=0) (stop) >> 52f0fe5f <= acl_mask: [5] mask: none(=0) >> 52f0fe5f => slap_access_allowed: read access denied by none(=0) >> 52f0fe5f => access_allowed: no more rules >> 52f0fe5f send_search_entry: conn 1003 access to attribute userPassword, >> value #0 not allowed >> 52f0fe5f conn=1003 op=20 ENTRY dn="uid=jdoe,ou=users,dc=example,dc=ldap" >> ber_flush2: 496 bytes to sd 21 >> >> >> >> -----Original Message----- >> From: openldap-technical-bounces(a)OpenLDAP.org >> [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, >> John - 0442 - MITLL >> Sent: Tuesday, February 04, 2014 9:31 AM >> To: Quanah Gibson-Mount; openldap-technical(a)openldap.org >> Subject: RE: Syncrepl and mmr >> >> All, >> >> This morning, I shut down slapd on mm-server2 and, using the ldif that I >> created off of mm-server1 primary dbase (used slapcat to create) and > attempted >> to resync the dbases. >> >> Background: when viewing the dbases on mm-server1 and mm-server2 on Apache >> Directory Studio (binding with cn=ldapadmin,dc=example,dc=ldap), the >> "ou=Users,dc=example,dc=ldap" will show the userPassword attribute on >> mm-server1, but NOT on mm-server2. If I perform an ldapsearch (again, with >> cn=ldapadmin,dc=example,dc=ldap, on both servers the userPassword attribute >> echoes out to console as expected. When binding to >> uid=replicator,ou=Admins,dc=example,dc=ldap on both servers, on the Apache >> Directory Studio, the userPassword attribute is seen. >> >> Now, this morning, as stated, slapd was shut down on mm-server2. >> >> Moved /var/lib/openldap/openldap-data out of the way Recreated the >> /var/lib/openldap/openldap-data directory, copying the DB_CONFIG back in. >> >> Chowned it the directory to ldap:ldap >> >> Ran: >> >> # slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l >> /usr/local/openldap/etc/openldap/ldif/backup/example_ldap.ldif >> _#################### 100.00% eta none elapsed none fast! >> >> Closing DB... >> # /usr/local/openldap/sbin/slapindex -F >> /usr/local/openldap/etc/openldap/slapd.d >> >> Reconnected, to mm-server2 via the Apache Directory Studio using >> cn=ldapadmin,dc=example,dc=ldap & > uid=replicator,ou=Admins,dc=example,dc=ldap, >> same results as before. >> >> Any suggestions? >> >> Thanks in advance, >> John >> >> -----Original Message----- >> From: openldap-technical-bounces(a)OpenLDAP.org >> [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, >> John - 0442 - MITLL >> Sent: Monday, February 03, 2014 4:22 PM >> To: Quanah Gibson-Mount; openldap-technical(a)openldap.org >> Subject: RE: Syncrepl and mmr >> >> Well...that was a "doh!" on my part. <lol> >> >> One last stupid question for the evening. "slapcat" created the ldif, when >> slapadd-ing to the the secondary, should I remove the extra lines (ex. >> entryUUID, creatorsName,createTimeStamp)? >> >> Thanks, >> John >> >> -----Original Message----- >> From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] >> Sent: Monday, February 03, 2014 4:03 PM >> To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org >> Subject: RE: Syncrepl and mmr >> >> --On Monday, February 03, 2014 3:57 PM -0500 "Borresen, John - 0442 - MITLL" >> <John.Borresen(a)ll.mit.edu> wrote: >> >>> Hmmmmmmmm, >>> >>> Taking your advice to reload the secondary from the primary...by >>> creating master set of ldifs off of the primary (mm-server1): >>> >>> On the primary (mm-server1): >>># slapcat -F /usr/local/openldap/etc/openldap/slapd.d -l # >>>backup/example_ldap.ldif -b dc=example,dc=ldap >>> 52f000f2 ldif_read_file: checksum error on >>>"/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" 52f000f2 >>> bdb_monitor_db_open: monitoring disabled; configure monitor database >>>to enable >>> >>> On the secondary (mm-server2): >>> the same command worked... >> >> There is no indication here the command failed. All it is reporting is that >> someone modified cn=config.ldif by hand rather than correctly using >> ldapmodify. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Architect - Server >> Zimbra, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration

1 0

RE: Antw: RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Thursday, February 06, 2014 12:32 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All, > > The oldDbDirectory statement is pointing to > /var/lib/openldap/openldap-data > > The accesslog olcDbDirectory statement is: /var/lib/openldap/accesslog Then one of those does not exist or is not accessible to the openldap user. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

RE: Antw: RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Thursday, February 06, 2014 12:37 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Then one of those does not exist or is not accessible to the openldap > user. Please read the OR portion of this sentence. You can also add -d -1 to your slapadd command to get more output on the error. Likely the permissons on one of /var, /var/lib, or /var/lib/openldap blocks access for the ldap user. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: Antw: RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Thursday, February 06, 2014 11:47 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All, > > I came in this morning, and the test environment was hung. Not sure what > is going on. slapd on both servers will not stay up for more than > 5-minutes. I tried to back step so attempted to slapadd from the > dbase.ldif that I created the other day when things were working. When > slapadding, I am receiving the following error: ># slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l ># /usr/local/openldap/etc/openldap/ldif/backup/mm-server2_example_ldap.ldif > 52f3bb11 olcDbDirectory: value #0: invalid path: No such file or directory > 52f3bb11 config error processing olcDatabase={1}bdb,cn=config: > olcDbDirectory: value #0: invalid path: No such file or directory > slapadd: bad configuration directory! The database directory you specified for slapd to use in olcDatabase={1}bdb,cn=config doesn't exist, as it clearly states. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

RE: Syncrepl and mmr
by Quanah Gibson-Mount 06 Feb '14

06 Feb '14

--On Monday, February 03, 2014 3:57 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Hmmmmmmmm, > > Taking your advice to reload the secondary from the primary...by creating > master set of ldifs off of the primary (mm-server1): > > On the primary (mm-server1): ># slapcat -F /usr/local/openldap/etc/openldap/slapd.d -l ># backup/example_ldap.ldif -b dc=example,dc=ldap > 52f000f2 ldif_read_file: checksum error on > "/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" 52f000f2 > bdb_monitor_db_open: monitoring disabled; configure monitor database to > enable > > On the secondary (mm-server2): > the same command worked... There is no indication here the command failed. All it is reporting is that someone modified cn=config.ldif by hand rather than correctly using ldapmodify. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 5

Re: OpenLDAP slapd problems - ldap_result: Can't contact LDAP server (-1) result.c:813 --- Low Sensitivity/Aerospace Internal Use Only
by Christian Kratzer 05 Feb '14

05 Feb '14

Hi Warraon, On Wed, 5 Feb 2014, Warron S French wrote: > Low Sensitivity/Aerospace Internal Use Only > > Thank you Christian, I don't know how to apply the patch, nor do I know > where to get it. I will just wait for 2.4.40 to be officially released. > Do you have any idea when that might be since I posted the issue last > Thursday? I know this is Open Source code, so I am wondering how long it > will be before I can continue with my dead-in-the-water project. I have no idea when the 2.4.40 release will be as I am not associated with the openldap project or their release management. Altough unless something serious turns up it will propably be a couple of months as 2.4.39 has just been released a week ago. As you have been cc:ing the ltb-project people on this list I assume you are using their packages ? If you are and are willing to compile their source package, then integrating the patch should not be too hard. It's just a matter of locating the patch in the git repository and adding it to the build. ps: Adding the list back to cc. Greetings Christian > Thanks, > > Warron French, MBA, SCSA > > > > From: Christian Kratzer <ck(a)cksoft.de> > To: Quanah Gibson-Mount <quanah(a)zimbra.com>, > Cc: Warron S French <Warron.S.French(a)aero.org>, > openldap-technical(a)openldap.org, ltb-users(a)mail.ltb-project.org > Date: 02/04/2014 04:37 PM > Subject: Re: OpenLDAP slapd problems - ldap_result: Can't contact > LDAP server (-1) result.c:813 --- Low Sensitivity/Aerospace Internal Use > Only > > > > Hi, > > On Tue, 4 Feb 2014, Quanah Gibson-Mount wrote: >> --On Tuesday, February 04, 2014 10:17 PM +0100 Christian Kratzer >> <ck(a)cksoft.de> wrote: >> >> >>> You should open an ITS for this. I will be glad to add my input once I >>> see the ITS. >> >> There already is an ITS for this, and the fix has already been committed > for >> the OpenLDAP 2.4.40 release, or one can grab the patch and apply it to > their >> 2.4.39 source and rebuild. > > saw your mail after sending. ;( > > Greetings > Christian > > -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/

1 0

Re: OpenLDAP slapd problems - ldap_result: Can't contact LDAP server (-1) result.c:813 --- Low Sensitivity/Aerospace Internal Use Only
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 10:17 PM +0100 Christian Kratzer <ck(a)cksoft.de> wrote: > You should open an ITS for this. I will be glad to add my input once I > see the ITS. There already is an ITS for this, and the fix has already been committed for the OpenLDAP 2.4.40 release, or one can grab the patch and apply it to their 2.4.39 source and rebuild. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

OpenLDAP slapd problems - ldap_result: Can't contact LDAP server (-1) --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 04 Feb '14

04 Feb '14

Low Sensitivity/Aerospace Internal Use Only Working on a CentOS-6.5 server, running LTB Project's slapd-2.4.38. Someone suggested I implement a cn=admin,cn=config for a cn=config setup. (I don't know how to technically word that). Anyway, I need to make TLS-related changes and was told to do the following command: ldapmodify -x -D "cn=admin,cn=config" -W -d 256 ...then at the blank line type the following, each on a single line: Dn: cn=config Changetype: modify Add: olcTLSCipherSuite OlcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 <CTRL-D> I have been getting an error reponse of: ldap_result: Can't contact LDAP server (-1) This __ONLY__ occurs after I hit <CTRL-D>, not before. Yes, the daemon, slapd, is actually running, but after this failure it abruptly stops. I know this because in a separate terminal on the same system, I am running a while-loop with a ps -e | grep slapd in it. Please note the "-x" option according to the man page for ldapmodify is supposed to Use simple authentication instead of SASL. Thank you all for your help, hopefully you can: 1) tell me what this error means, and 2) how to fix my problem so that I can complete the olcTLSxxxx changes I need to implement. Warron French, MBA, SCSA The Aerospace Corporation Sr. UNIX SA & Storage Admin Mailstop: CH1-230 Desk: 571-307-5311 Cell: 703-967-8936 Low Sensitivity/Aerospace Internal Use Only

4 16

re: search on multimaster gives 2 different results
by Gare Calhoun 04 Feb '14

04 Feb '14

Hello, Follow-up on how I solved this issue: Dumped an ldif copy of the offending server and reloaded that server with slapadd. This corrected the autogroups on that server. We are doing a lot of programmatic additions, updates, and deletions to OpenLDAP, which could have caused the initial issue. hth someone. Gare - *To*: *openldap-technical(a)openldap.org <openldap-technical%40openldap.org>* - *Subject*: *search on multimaster gives 2 different results* - *From*: *Gare Calhoun <gcalhoun(a)antioch.edu <gcalhoun%40antioch.edu>>* - Date: Thu, 19 Dec 2013 16:56:00 -0600 ------------------------------ Hello, We are running 2 servers in multimaster mode ; openldap-2.4.35 on CentOS 6.6 using the autogroup overlay. I have a search filter (APersonCategory=*ADJ*) that returns different numbers of records when queried against each server. The actual records exist on both servers. 1 server is not returning all expected records. The other server returns records as expected. There is no index defined for this attribute in slapd.conf on either server. schema definition of attribute is same on each server: attributetype ( 1.3.6.1.4.1.5923.1.1.1.23 NAME 'APersonCategory' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) Would someone suggest what to look at to troubleshoot this? Thank you very much for your assistance. -Gare Calhoun -- . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gare Calhoun Antioch University IT Services, Software Developer

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical