openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

If i can't use multi master with refreshandpersist then why its given at all. i was able to get replication working with same configuration in other testing environment, but with very less users 1m only. I am having all this running in production, but replication is not working. What should be my strategy to add new consumer, where my provider is running with mdb db size of 200G in production. i don't want to mess with configuration changes on master or with minimum changes. Any other suggestions are all welcome. On Wed, Jan 16, 2013 at 12:46 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, January 15, 2013 6:53 PM +0000 Chris Card < > ctcard(a)hotmail.com> wrote: > > This second problem doesn't happen consistently, but because I don't >> understand why it happens or how to fix it consistently, I can't go ahead >> with the production upgrade to delta-syncrepl, which is very frustrating. >> We are currently running openldap 2.4.31, but I do plan to see if 2.4.33 >> or RE24 behaves better. However, looking at the openldap sources I >> haven't spotted any fixes which look likely to help. >> Any ideas? >> > > I take it you are replicating cn=config then? I never do that, so hard > for me to comment on issues that may arise by doing that. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Using policy overlay
by rodrigo tavares 16 Jan '13

16 Jan '13

Hello ! I´m with troubles, in trying to load policy overlay,it is /usr/lib/ldap/ppolicy.so. Then I put overlay ppolicy in slapd.conf. So, restart openldap. But is com error: Jan 16 16:08:12 defensoria slapd[14010]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Jan 16 16:08:12 defensoria slapd[14010]: overlay "ppolicy" not found Jan 16 16:08:12 defensoria slapd[14010]: slapd stopped. Jan 16 16:08:12 defensoria slapd[14010]: connections_destroy: nothing to destroy. Anybody Can to help me ? Thanks ! Rodrigo Faria

2 3

Re: uninstall?
by Ori Bani 15 Jan '13

15 Jan '13

>> Is there a make rule for uninstallation? "make uninstall" doesn't do >> the trick... >> >> If there's not, is there any recommended way to handle removing >> OpenLDAP that was installed from source? > > > Use --prefix so you install everything into the path you want? Otherwise, > no, no particularly easy way to uninstall. Hmmm, OK thank you.

1 0

uninstall?
by Ori Bani 15 Jan '13

15 Jan '13

Hi, Is there a make rule for uninstallation? "make uninstall" doesn't do the trick... If there's not, is there any recommended way to handle removing OpenLDAP that was installed from source? Thank you!

2 1

Permissions, users, startup when install from source
by Ori Bani 15 Jan '13

15 Jan '13

Hi, If compiling and installing from source, I don't see any information in the manual about how to auto-start the software and about process/file/directory permissions and ownership. I'm still searching the Faq-O-Matic (which is a little frustrating). Taking a step back, I'd love to install from yum on RHEL/CentOS and let it be taken care of in a trusted manner. But we require better password hashing than SHA1, so we are required to compile by hand using the passwd/sha2 contributed module (little surprised this isn't accepted into the core project, but I'm sure there are reasons). Maybe I can find this in a third-party repo somewhere? After installation, what is commonly done in this regard? Create user/group "ldap" with no login shell and chown ldap:ldap on /usr/local/var/openldap-data? Is that all? Then what do people use for auto-starting the software (presumably with -u ldap -g ldap) in a RedHat environment? Thanks for the work that you do, thanks for the great software.

2 1

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 15 Jan '13

15 Jan '13

> > Yes, that would significantly increase memory usage. I have only ever done > the *second* modification (BDB_IDL_LOGN) to fix the IDL issues. I've run > that way for years. How much have you increased the BDB_IDL_LOGN -> 2^17 or more, would be interesting for me, because we are nearly reach this size too. > Try dropping the modification to LDAP_PVT_THREAD_STACK_SIZE. It has never > been necessary for any of my customers, many of whom have DBs with 6 to 10 > million entries. Ok, thanks, I'll do this and check. Thanks Mike

2 1

Fwd: adding support to mdb
by Friedrich Locke 15 Jan '13

15 Jan '13

Dear gentleman/madam, as you may be aware i am having hard times trying to get qmail+ldap working on my OpenBSD 5.2 amd64. While after installation OLDAP works 100% (I am using BDB as backend). When i start qmail, every query sent by qmail to the OLDAP server increases memory up to a point OLDAP needs to be restarted. I emailed misc(a)openbsd.org. I got responses. Here i pass them to the OLDAP developer: After some advice from Mr. Quanah, i gave up BDB and would like to give MDB a try. Here is what i got from the misc(a)openbsd.org I believe the OLDAP developer should know: ---------- Forwarded message ---------- From: Stuart Henderson <stu(a)spacehopper.org> Date: Mon, Jan 14, 2013 at 8:47 PM Subject: Re: adding support to mdb To: Friedrich Locke <friedrich.locke(a)gmail.com> Cc: ports(a)openbsd.org On 2013/01/14 19:18, Friedrich Locke wrote: > Hi folks, > > this is my first message to this list. I am writing because i am in need to > use openldap from ports. > Initially i tried openldap with support to BDB, but it is buggy. > I was suggest to try mdb, but openldap's Makefile have the --disable-mdb > instruction. > > Since i do need to get a directory service and have no knownledge on > openldap internals, i come to you > in order to suggest how could i help in order to get mdb supported by > OpenBSD Ports OpenLDAP. > > Thank you a lot for your time and cooperation. > > Best regards, > > Fried. So this is a memory-mapped database; there have been problems with these in the past (e.g. in Cyrus imapd and Dovecot) but I am not sure of all the details. The port diff is easy enough but I would really like some advice from someone who is knowledgeable about the mmap issues as to whether or not it's safe to use this on OpenBSD. A bit more info from slides at http://www.openldap.org/pub/hyc/mdm-slides.pdf :- -- -- -- -- -- * Uses a read-only memory map * Protects the database structure from corruption due to stray writes in memory * Any attempts to write to the map will cause a SEGV, allowing immediate identification of software bugs * There's no point in making the pages writable anyway, since only existing pages may be written. Growing the database requires file ops (write, ftruncate) so for uniformity, file ops are also used for updates. -- -- -- -- -- I *think* the problems were only with mmap writes, if this is correct then they seem to be sidestepping the problems by doing this. BTW I'm using OpenLDAP 2.4 with BDB here and haven't noticed issues however it is not under extreme load..

2 1

Fwd: adding support to mdb
by Friedrich Locke 15 Jan '13

15 Jan '13

This one too. []s ---------- Forwarded message ---------- From: Stuart Henderson <stu(a)spacehopper.org> Date: Tue, Jan 15, 2013 at 6:41 AM Subject: Re: adding support to mdb To: Friedrich Locke <friedrich.locke(a)gmail.com> On 2013/01/14 21:31, Friedrich Locke wrote: > Hi! > > people from openldap group have already migrated to mdb. > Why OpenBSD has such problems. On other OSes, things work nicely. > BTW, no offense, i do like obsd, but things like make me upset. I suspect that the MDB code probably requires something from the OS that OpenBSD doesn't have (coherent buffer and page caches - http://utcc.utoronto.ca/~cks/space/blog/unix/UnifiedCacheMmap) If I'm correct then it will appear to work, but with a risk of database corruption. For this reason I won't enable this in the OpenLDAP port unless someone who knows the area well is satisfied that it's safe. Some other database code which likes to use mmap (e.g. cyrus skiplist) takes into account the various types of cache behaviour and has options to avoid using mmap. It doesn't appear that MDB has this yet.

1 0

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 15 Jan '13

15 Jan '13

>> >>> From slapd.conf/cn=config: >>> a) cachesize setting >>> b) idlcachesize setting >>> c) dncachesize setting >> >> >> cachesize 750000 >> dncachesize 750000 >> idlcachesize 2250000 >> >> Thanks and best regards > > > Your settings here don't make a lot of sense. > > I would try > cachesize 1500000 > dncachesize 0 (or leave it unset) > idlcachesize 3000000 > Yes, I know this values are very low in my configuration, but if I have problems with the memory, should I increase the caches that use this memory? In the last thread , you confirmed, that if I increasing the DB cachesize, the system is faster running out of memory. http://www.openldap.org/lists/openldap-technical/201211/msg00171.html ("ch_realloc means the system ran out of memory. Increasing the DB_CONFIG cachesize will run you out of memory more quickly.") To get the slapd a little bit more stable, I reduced this values (caches) to the posted in last message. Before i had: cachesize 1000000 dncachesize 1000000 idlcachesize 3000000 > Your current idlcachesize in particular may be part of the issue in addition > to your glibc setting. But the problem exist on the test system with tcmalloc too. So are 24GByte RAM for 1.500.000 DNs and 6GByte DB are not enough? During all time (especially the crash), there was enough physical (unallocated) memory free. But "slapd/malloc" tried to allocate more and more (as you can see in the post from 2013/01/12), but did not use it, no matter if glibc or tcmalloc I hope I interpreted it right?! Thanks Meike Btw.: I use a "special version" of openldap. Because of limited index slot of 65535, I changed in openldap-2.4.33.orig/include/ldap_pvt_thread.h from # define LDAP_PVT_THREAD_STACK_SIZE ( 1 * 1024 * 1024 * sizeof(void *) ) to # define LDAP_PVT_THREAD_STACK_SIZE ( 2 * 1024 * 1024 * sizeof(void *) ) and in openldap-2.4.33/servers/slapd/back-bdb/idl.h from #define BDB_IDL_LOGN 16 /* DB_SIZE is 2^16, UM_SIZE is 2^17 */ to #define BDB_IDL_LOGN 17 /* DB_SIZE is 2^17, UM_SIZE is 2^18 */ as Howard it recommended http://www.openldap.org/lists/openldap-technical/201101/msg00095.html Maybe this could be the problem?? My changes are available under: https://build.opensuse.org/package/show?expand=0&package=openldap2&project=…

2 1

Using smbtools an create account
by rodrigo tavares 15 Jan '13

15 Jan '13

Hello People. I have a samba server and LDAP, it´s running, but i put the slap replicate, come this error: root@replica:/etc/smbldap-tools# smbldap-useradd -a ola Error: shadow context; no update referral at /usr/share/perl5/smbldap_tools.pm line 1187. If I remove config slap replicate is run. syncrepl rid=123 provider=ldap://10.65.11.250:389 type=refreshOnly interval=00:00:05:00 retry="60 30 300 +" searchbase="dc=net,dc=mg,dc=gov,dc=br" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=net,dc=mg,dc=gov,dc=br" credentials=secret Any idea ? Rodrigo Faria

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical