openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

deleting all entries
by jeevan kc 03 Dec '12

03 Dec '12

HelloWe are deleting all the entries from the Test ldap server and migrating the production data into the test server. I believe slapcat and slapadd would come handy for the migration part. But what I am concerned now is removing the entries from the Test server. How do I delete them ? I need to empty the server but then I want to keep the current configuration and schemas. My openldap on the server is built from the source and the DB files are located on /usr/local/var/openldap-data.Any ideas would be appreciated . Thank you.

1 0

last login time
by Jignesh Patel 03 Dec '12

03 Dec '12

How to capture last login time in openLDAP? -Jignesh

5 11

Re: Index Add Failures
by Kyle Smith 03 Dec '12

03 Dec '12

Ok, I have been running 2.4.32 for some time with no issues. Yesterday, 2 different servers (both part of a 4-way MMR) produced an "index add failure" and an "index delete failure". I went back over the bdb DB_CONFIG Settings (listed below) and everything looks nominal to me. Would it just make more sense to switch from bdb to mdb instead of troubleshooting these "random" errors too much? I also noticed that the number of "deadlocks" corresponds to the number of errors that were produced. Is there correlation there? Thanks! 578 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 3000 Maximum number of locks possible 1500 Maximum number of lockers possible 1500 Maximum number of lock objects possible 1 Number of lock object partitions 15 Number of current locks 1029 Maximum number of locks at any one time 17 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 123 Number of current lockers 224 Maximum number of lockers at any one time 15 Number of current lock objects 526 Maximum number of lock objects at any one time 5 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 3581M Total number of locks requested (3581768929) 3581M Total number of locks released (3581768869) 0 Total number of locks upgraded 77 Total number of locks downgraded 7041 Lock requests not available due to conflicts, for which we waited 43 Lock requests not available due to conflicts, for which we did not wait 2 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 1MB 392KB The size of the lock region 0 The number of partition locks that required waiting (0%) 0 The maximum number of times any partition lock was waited for (0%) 0 The number of object queue operations that required waiting (0%) 577 The number of locker allocations that required waiting (0%) 32148 The number of region locks that required waiting (0%) 5 Maximum hash bucket length On Wed, Aug 29, 2012 at 12:04 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, August 29, 2012 11:32 AM -0400 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > Quanah, Thanks for the info, I have confirmed I'm hitting the lock maxes >> of 1000. And I will be upgrading to 2.4.32. I was wondering, what steps >> should be done to have the changes in DB_CONFIG take effect? >> >> >> stop slapd >> make changes to DB_CONFIG >> db_recover >> start slapd >> >> >> Will this also auto remove the log.* files? ( I plan on setting this: >> "set_flags DB_LOG_AUTOREMOVE" in DB_CONFIG) >> > > If you have checkpointing set in slapd.conf/cn=config, it should, yes. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 15

Optimization help
by Pawan Kamboj 30 Nov '12

30 Nov '12

Hi, What can I do to maximize the performance of my openldap setup which running in master-slave mode using syncrepl? System has 8GM RAM and 4GB swap space Openldap-2.3.32 and DB.4.5 ---------------------------------- Total dn count is 2450000. LDIF size is 670MB using ldapsearch dbd size is : du -c -h *.bdb 69M authenticationId.bdb 227M cn.bdb 602M dn2id.bdb 27M entryCSN.bdb 24M entryUUID.bdb 2.5G id2entry.bdb 6.4M mail.bdb 4.6M objectClass.bdb 16M ou.bdb 263M sn.bdb 740M uid.bdb 4.4G total ----------------------- Portion of slapd.conf: cachesize 50000 checkpoint 4096 10 sizelimit 2500000 ------------------------- DB_CONFIG # Set the database in memory cache size. set_cachesize 2 0 1 # Set database flags. set_flags DB_TXN_NOSYNC set_lk_max_locks 2000 set_lk_max_objects 1000 set_lk_max_lockers 1000 set_txn_timeout 3000000 set_lock_timeout 3000000 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lg_dir /usr/local/var/master/logs db_stat -h /usr/local/master/db -m | head -n 2 2GB Total cache size 1 Number of caches Thanks Pawan Kumar

2 1

slapo-pcache seems broken in openldap-2.4.31
by Tio Teath 30 Nov '12

30 Nov '12

I'm trying to set up slapo-pcache using cn=config, and this is my settings: dn: olcDatabase={1}ldap,cn=config objectClass: olcConfig objectClass: olcDatabaseConfig objectClass: olcLDAPConfig objectClass: top olcDatabase: {1}ldap olcRootDN: cn=admin,cn=config olcAccess: {0}to * by * read olcDbACLBind: bindmethod=simple binddn="ou=group,dc=remote" credentials="password" tls_cacert="/etc/ssl/certs/ca-certificates.crt" starttls=yes olcDbURI: ldap://remote.host olcSuffix: dc=remote dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: hdb 10000 1 50 100 olcPcacheAttrset: 0 member olcPcacheTemplate: "(objectClass=)" 0 3600 dn: olcDatabase={0}hdb,olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcPcacheDatabase objectClass: olcHdbConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {0}hdb olcDbDirectory: /var/lib/ldap/cache olcDbIndex: objectClass eq olcDbIndex: pcacheQueryid eq But each time I'm trying to run ldapsearch -b"cn=test2,ou=group,dc=remote" '(objectClass=*)' member I'm getting QUERY NOT ANSWERABLE/QUERY NOT CACHEABLE errors in the log. Besides, it is impossible to modify attributes olcPcacheTemplate/olcPcacheAttrset: modify/add: olcPcacheTemplate: no equality matching rule Can anyone confirm that the one have managed to make slapo pcache working on 2.4.31?

2 1

monitoring openldap 2.0.27 connections
by santosh malavade 29 Nov '12

29 Nov '12

Hi, We are using openldap version 2.0.27 on RHEL AS 3 with Postfix 2.2.10 In postfix logs, I have seen the following warning message: warning: dict_ldap_connect: Unable to bind to server ldap://127.0.0.1:389 as <dn>: 85 (Timed out) The default timeout is set as 10 seconds. How do I monitor my ldap server. I would like to know the active connection counts on my ldap server. Rgds, Santosh

5 5

MirrorMode Replication Problem
by rocketdive5＠yahoo.co.jp 29 Nov '12

29 Nov '12

Hello, I set up 10 OpenLDAP Servers in MirrorMode replication. (Using OpenLDAP 2.4.24) syncrepl [Server1] provider: server10, server2 [Server2] provider: server1, server3 [Server3] provider: server2, server4 [Server4] provider: server3, server5 [Server5] provider: server4, server6 [Server6] provider: server5, server7 [Server7] provider: server6, server8 [Server8] provider: server7, server9 [Server9] provider: server8, server10 [Server10] provider: server9, server1 (like the shape of a ring.) When data was updated by Server1, the value was updated only by Server1 and Server3. (Reproducibility is low) Question * How to investigate the cause which was not replicated? * Although all the servers become a setup which serves both as a provider and a consumer, is there any problem? * Is there the method(API) that can detect what was replicated? Thanks. Hiro Configuration Server1 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 1 syncrepl rid=2 provider=ldap://server2 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=10 provider=ldap://server10 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on --------------------------------------------------------------- Server2 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 2 syncrepl rid=1 provider=ldap://server1 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=3 provider=ldap://server3 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on --------------------------------------------------------------- Server3 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 3 syncrepl rid=2 provider=ldap://server2 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=4 provider=ldap://server4 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on --------------------------------------------------------------- .... Server10 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 10 syncrepl rid=9 provider=ldap://server9 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=1 provider=ldap://server1 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on ---------------------------------------------------------------

3 3

ldap_bind parse result: Decoding error (-4)
by Kaushal Shriyan 28 Nov '12

28 Nov '12

Hi, Any clue about this error "/usr/bin/ldapadd -x -W -D "cn=root,dc=mydomain,dc=com" -f ./base.ldif I get ldap_bind parse result: Decoding error (-4). " Regards Kaushal

2 2

Re: MSYS build and PCRE - Good news
by Anton Malov 28 Nov '12

28 Nov '12

I have answered you yesterday. PCRE build doesn't produce libraries required by OpenLDAP configure script. OpenLDAP requires libregex.a or libgnuregex.a but PCRE builds to libpcre.a libpcreposix.a and libpcrecpp.a. If you successfully built OpenLDAP than you linked it to another regex library, not PCRE. I have solved the problem by adding LIBS=-lpcre to configure script. On Wed, Nov 28, 2012 at 4:01 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: >> > I mentioned my steps in a previous email. Did you receive it? >> Yes, I did. I have a question for you. What was the output of your >> PCRE build? Which static libraries did it produce? >> I think there may be difference between the distro libraries I am >> using and custom PCRE build. > > Any news Anton? You can build static or shared or both PCRE libraries. As > long as OpenLDAP can find the header and lib files, it should be ok! I > tested it yesterday and no problem at all.

1 0

Modify cn=config
by Rob "Bubba" Hines 28 Nov '12

28 Nov '12

It's been a while since I touched LDAP, so I'm new to the latest configuration changes. Admittedly, I find it aggravating that I can't simply shutdown the LDAP server and modify the configuration, and start it back up. Regardless, my intern stuck the wrong paths in for the TLSCerts, ldap will not start up now ... I need to modify cn=config with the correct paths, but I can't figure out how to get slap* to do it. It hates my ldif, and I just want a simple way to change those three paths. I assume that somewhere in the arcane knowledge that is LDAP, there is a simple solution. But my Google FU has failed me, tho it has served up numerous threads that talk around the problem without providing a solution (or the solution provided was simply 'use slapadd' with no direction on how to 'use slapadd'). Here is the latest ldif I've attempted to use (to no avail) with slapadd: dn: cn=config objectClass: olcGlobal cn: config olcTLSCACertificateFile: /etc/ldap/tls/cacert.pem olcTLSCertificateFile: /etc/ldap/tls/slapd.d/slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/tls/slapd.d/slapd_key.pem I assume I just don't know how to write a correct LDIF. But I would appreciate any help in modifying cn=config with the server down. -- Rob "Bubba" Hines * Bubba <http://blog.hines57.com/> * Bubba on LinkedIn <http://www.linkedin.com/in/robhines> * Bubba on Twitter <http://twitter.com/#%21/robhines> * Bubba on Facebook <http://www.facebook.com/people/Robert-Hines/679491526> * Bubba on Plaxo <http://www.plaxo.com/profile/showPublic/robhines> * Bubba's Klout <http://klout.com/#/robhines> * Bubba on Google <https://plus.google.com/u/0/110941764679832570087/about>

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical