openldap-technical

openldap-technical@openldap.org

23 participants
9804 discussions

replication issues
by Marvin Mundry 20 Mar '12

20 Mar '12

Hello everybody, i am experiencing 2 issues while using syncrepl. i am running slapd 2.4.20 shipping with SLES 11.2. 1. replication of an accesslog database. ============================= the accesslog overlay does not assign an entryUUID to its logdb database. therefore replication of this database is not possible. dn: cn=accesslog objectClass: auditContainer cn: accesslog entryCSN: 20120317121350.967741Z#000000#000#000000 structuralObjectClass: auditContainer contextCSN: 20120320154322.642649Z#000000#000#000000 To be able to replicate cn=accesslog anyways, i initialize the accesslog database via slapadd from an ldif file that contains a made up entryUUID for dn:cn=accesslog, afterwards i fire up the slapd. Replication now seems to work fine. My question is, does this method have any unwanted side effects? 2. replication of cn=config =================== when replicating cn=config all objects below cn=schema,cn=config get replicated when the consumer is initially started. for dn:olcDatabase={-1}frontend,cn=config and dn:cn=config (olcGlobal) initially no synchronization happens. Both objects get replicated only after they have been modified on the on the provider ie. when starting a new consumer i have to carry out meaningless modifications to both objects on the provider to initiate the replication. is this behavior to be expected? my syncrepl config is: syncrepl rid=15 provider=ldap://192.168.2.100 type=refreshAndPersist retry="1 1 1 1" searchbase="cn=config" filter="(|(objectClass=olcGlobal)(objectClass=olcSchemaConfig)(objectClass=olcFrontendConfig))" attrs="*,+" bindmethod=simple binddn="cn=admin,cn=config" credentials="secret" Best regards, Marvin

2 2

mdb hmmm....
by Francis Swasey 20 Mar '12

20 Mar '12

I thought I'd give mdb a try to see if it will solve a performance problem I'm approaching with my current ldap servers. But, I have obviously missed some key step. I have been running 2.4.28 on RHEL5 64-bit, using an hdb database. The steps I followed were: - slapcat the existing database - stop slapd - build 2.4.30 and install it - update my slapd.conf to use mdb, remove the cachesize, cachefree, and idlcachesize options (which are not valid with mdb), and add the maxsize option set to 100GB (107374182400). Then, I ran slapadd with -q and it blew up on me: slapadd -q -b dc=uvm,dc=edu -l ../cheese.ldif 4f68cc21 => mdb_idl_insert_keys: c_get failed: Invalid argument (22) 4f68cc21 => mdb_tool_entry_put: index_entry_add failed: err=80 4f68cc21 => mdb_tool_entry_put: txn_aborted! Internal error (80) slapadd: could not add entry dn="cn=XXobfuscatedXX,ou=People,dc=uvm,dc=edu" (line=771): txn_aborted! Internal error (80) _ 0.01% eta 02m06s elapsed none spd 3.4 M/s Closing DB... Now, just to convince myself that I wasn't bonkers, I updated the slapd.conf file to go back to hdb and the slapadd command runs just fine. I've read the slapd-mdb man page, scoured the openldap-technical mailing list, even the faq-o-matic and the admin guide. I'm not finding any clues to what is causing slapadd to fail here. -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

error entry store failed
by Wen, Nancy 20 Mar '12

20 Mar '12

Hi folks, Can anyone help me on this problem? Note we were trying to know what happen on a previous error - Sizelimit exceeded. However, after we turned the log level up, and we saw this: => id2entry_add( 322, "uid=jason,ou=people,ou=0019,l=taiwan,dc=039,dc=com" ) => ldbm_cache_open( "id2entry.dbb", 73, 600 ) <= ldbm_cache_open (cache 1) <= id2entry_add 30988 id2entry_add failed => dn2id_delete( "uid=jason,ou=people,ou=0019,l=taiwan,dc=039,dc=com", 322 ) => ldbm_cache_open( "dn2id.dbb", 73, 600 ) <= ldbm_cache_open (cache 0) <= dn2id_delete 0 send_ldap_result: conn=0 op=40 p=3 send_ldap_result: err=80 matched="" text="entry store failed" send_ldap_response: msgid=41 tag=105 err=80 conn=0 op=40 RESULT tag=105 err=80 text=entry store failed ====> cache_return_entry_w( 206 ): returned (0) ====> cache_return_entry_w( 322 ): deleted (0) @(#) $OpenLDAP: slapd 2.2.13 (Aug 13 2006 01:27:00) $ buildcentos@build-i386 :/home/buildcentos/rpmbuild/BUILD/openldap-2.2.13/openldap-2.2.13/build-servers/servers/slapd daemon: bind(6) failed errno=98 (Address already in use) daemon: bind(6) failed errno=98 (Address already in use) slapd stopped. Thanks million, Nancy Wen

2 1

translucent plugin
by Alex Samad - Yieldbroker 19 Mar '12

19 Mar '12

Hi I was wondering if the translucent plugin will allow me to add whole objects So if I had Openldap translucent -> MS AD Suffix dc=test,dc-com Could I add who objects and not just attributes into the tree ? Alex

1 0

mirrormode and N-way multimaster replication
by mallapadi niranjan 19 Mar '12

19 Mar '12

Hi all I am trying to understand the differences between mirrormode and N-way multimaster replication. I am using openldap-2.4.23-20.el6 , From the admin guide from www.openldap.org , I would like to clarify the below point In Mirromode . if i have two openldap servers(m1-m2), I can do add/del/mod operations only on m1, but cannot do add/del/mod operations simultaneously on both m1 and m2 , I can do add/del/mod operations on m2 only when m1 is down. Where as In N-Way multimaster replication, (if m1 and m2 are two openldap servers), i can do add/mod/del operations on both m1 and m2 simultaneously , Can some body clarify if the above understanding is correct. Regards Niranjan

2 1

src rpms for 2.4.30 / RHEL 6
by Aaron Bennett 19 Mar '12

19 Mar '12

Hello, For a number of reasons, I wanted to package OpenLDAP 2.4.30 for RHEL 6. If anyone's interested, you can get my package here... http://wordpress.clarku.edu/abennett/2012/03/16/openldap-src-rpms-for-rhel-… It depends on DB5 so you'll find a src rpm for that as well. All the binaries go into /usr/local; configuration is in /etc/openldap and /etc/sysconfig; bdb files go in /var/lib/ldap. The init script is the regular RHEL 5 patched to run the binary from a different location. It conflicts with openldap-servers and openldap-clients but NOT with the base system openldap. Let me know if it works for you or if you find issues with it. Best, Aaron --- Aaron Bennett Manager, Systems Administration Clark University ITS

4 7

OpenLDAP high CPU usage when performing mass changes
by Jeffrey Crawford 18 Mar '12

18 Mar '12

We are using openldap 2.4.26 with BDB 4.8 and have replication set up in mirror mode for our main ldap database. There are a couple of other replicas that have a subset of the data that the main cluster has but we are seeing the following behavior on all of them. When performing mass updates via LDAP, lets say on the order of 30,000 entries being added to existing entries. We've noticed that the CPU use of the slapd instances goes through the roof (between 65% and 95% continuously), and seems to stay there until it is restarted. The Problem is that this system has to be highly available, even for writing and when these updates "shock" the system, the response time goes way down when the process are turning like that. I don't think they are trying to catch up to the data changes because if I let them run a while after the updates are done. (Talking like 1hr) and then restart the instances, they go back to their normal state. So far the only way I've been able to mitigate the issues is to reconfigure our ldap proxy instances to a machine that is having less trouble, restart the instances that are chugging along, then repoint the proxies back to the one just started, and start the others. Not exactly a quick operation. I've played with cache settings for both OpenLDAP and BDB and have gotten the frequency of this issue reduced but I can't seem to get rid of it completely and it shows up quite often after large data manipulations. I'm at a loss of how to debug since nothing is crashing. Any suggestions on how to find out what's causing this would be very helpful. The logs are not throwing any warnings or posting messages that would seem out of the ordinary and I have played with the log settings but nothing seems to relate to anything that might explain why we are seeing CPU usage to go so high. Thanks in advance -- I fly because it releases my mind from the tyranny of petty things . . . — Antoine de Saint-Exupéry Jeffrey E. Crawford ITS Application Administrator (IDM) 831-459-4365 jeffreyc(a)ucsc.edu

3 7

ldapi vs ldap
by Nick Milas 18 Mar '12

18 Mar '12

Hi, For applications accessing a directory (mainly Postfix, Dovecot, PowerDNS), we are replicating locally and applications connect using: ldap://localhost. We are considering using ldapi://localhost instead. Would there be any performance / reliability pros/cons? Thanks, Nick

3 2

Re: URI="(null)" DN="" (Was: ldap && rwm && pcache && transparent)
by Brian Thompson 17 Mar '12

17 Mar '12

Hello, We're running into almost exactly the same issue that Turbo described a few months ago and I'm not exactly sure what to try next... Basically there are two remote directories that we only have read-only access to via fixed set of bind credentials. Both directories have the same naming contexts and same user entry DNs but a slightly different non-conflicting set of user attributes. What we would like to do is create a combined merged view that contains the user entry attribute responses from both remote directories displayed as a single entry and allow anonymous access via the local lan. Only one of the two directories has the specific attribute being searched for but again we would like the response to include the full set of attributes from both directories and the entry DNs do match. So, I'm attempting to use slapd-ldap for the first remote directory and slapo-translucent for the second remote directory but can't seem to make the two mechanisms cooperate with each other. The errors are the same as what Turbo described. If I change the database from slapd-ldap to slapd-shell or slapd-hdb (empty db), the slapo-translucent portion works correctly and I can see the attributes in the searched entry retrieved from the second remote directory. If I leave the slapd-ldap configuration in place and comment out the overlay translucent portion, the slapd-ldap portion works correctly and I can see the attributes in the searched entry retrieved from the first remote directory. Still no luck on getting both to work at the same time though so that it combines the attributes from both entries into a single response. Here's the pertinent portion of the config: backend ldap database ldap suffix "dc=example,dc=com" uri "ldap://172.16.16.16/" idassert-bind mode=none bindmethod=simple binddn="uid=readonly1,cn=admins,dc=example,dc=com" credentials="secret1" flags=override,non-prescriptive overlay translucent uri "ldap://172.17.17.17/" idassert-bind mode=none bindmethod=simple binddn="uid=readonly2,cn=admins,dc=example,dc=com" credentials="secret2" flags=override,non-prescriptive If anyone has any ideas why the above isn't working or knows of a cleaner way to do it, please let me know. It would be much appreciated. Thanks, Brian ----- Original Message ----- > On Wed, 14 Sep 2011 20:53:03 +0200, Turbo Fredriksson wrote: > > I'm trying to proxy an AD and an OpenLDAP server on a > > separate machine to get a 'combined' view. > > Some more testing and finding a loglevel that doesn't drown me > in information, I see this: > > ----- s n i p ----- > [...] > slapd starting > conn=1000 fd=13 ACCEPT from IP=127.0.0.1:54815 (IP=0.0.0.0:389) > conn=1000 op=0 BIND dn="" method=128 > conn=1000 op=0 RESULT tag=97 err=0 text= > conn=1000 op=1 SRCH base="dc=company,dc=tld" scope=2 deref=0 > filter="(uid=kpxb140)" > conn=1000 op=1 SRCH attr=uid > [...] > conn=1015 fd=43 ACCEPT from IP=127.0.0.1:54830 (IP=0.0.0.0:389) > conn=1015 op=0 BIND dn="" method=128 > conn=1015 op=0 RESULT tag=97 err=0 text= > conn=1015 op=1 SRCH base="dc=company,dc=tld" scope=2 deref=0 > filter="(uid=kpxb140)" > conn=1015 op=1 SRCH attr=* + > daemon: shutdown requested and initiated. > conn=1015 op=1 SEARCH RESULT tag=101 err=52 nentries=0 text=Proxy > operation retry failed > slapd shutdown: waiting for 18 operations/tasks to finish > conn=1015 fd=43 closed (slapd shutdown) > daemon: accept(-1) failed errno=9 (Bad file descriptor) > [...] > conn=1000 op=1 ldap_back_retry: retrying URI="(null)" DN="" > conn=1000 fd=13 closed (slapd shutdown) > RESETTING CACHED QUERY URLS > slapd stopped. > ----- s n i p ----- > > > So on the last connection, I get 'Proxy operation retry failed' and on > all > the rest 'retrying URI="(null)" DN=""'. So I'll asume that there's a > URI > on conn=1000. > > > But why do I get these problems? Isn't slapo-translucent supposed to > work > with slapd-{ldap,meta}? > > > > ------------------------------

2 1

segfault in slapd
by A Malaviya 16 Mar '12

16 Mar '12

Hi, I've a provider-consumer setup using syncrepl on which I'm experiencing segfaults on the provider. Daily there are about 4 - 5 segfaults. Weirdly it seems as if the segfaults happen when we do ldapsearch on the entire database within short intervals. The segfault line gives 'error 4' at the end. My openldap version is 2.4.23. Pls suggest some resolution for the prb. A Malaviya.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical