openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Large "dynamic" groups and performance
by Al 11 Apr '11

11 Apr '11

Hi All - We are currently attempting to migrate from a commercial LDAP server to OpenLDAP. Luckily our data is pretty standard, and the migration itself will be simple. I am having issues with our groups that programatically have large numbers of adds and deletes done to its member list. This transaction happens when a user logs into our website (the login mechanism compares their current groups with what they should have (from an external DB query) and makes the necessary adjustments). Other applications then use these groups for permissions. We are using the basic uniquemember within a groupOfUniqueNames. Uniquemember is indexed with equality. When the groups are small, performance is quite good - but once the groups begin growing, the adds and deletes of the members really starts suffering ( greater than 2 - 3 seconds per person). The reads still seem good. On our existing LDAP store, we see response times of less than a second for this same transaction. We have about 175 groups, that range in size from 10 members to 50,000 members. Most of the groups are around 1,000 members. I can go into more detail of the exact sizes if needed. I have a very basic configuration right now for testing. I've messed around with different transaction log settings, different caching settings and even played with DB_TXN_NOSYNC. DB_TXN_NOSYNC definitely helped, but its still not great. Can anyone recommend any settings that might help me improve the performance? Thanks in advance! My environment and settings: HP blade server, 8 cores @ 2.67Ghz, Redhat 5.3, OpenLDAP 2.4.25, Berkeley 5.1.25: ###### slapd.conf include /mypath/etc/openldap/schema/core.schema pidfile /mypath/var/run/slapd.pid argsfile /mypath/var/run/slapd.args access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth database bdb suffix "dc=my,dc=domain,dc=com" rootdn "cn=Manager,dc=my,dc=domain,dc=com" cachesize 500000 rootpw my_pass directory /mypath/var/openldap-data index objectClass eq index uniquemember eq index cn pres,eq,sub ###### DB_CONFIG set_cachesize 2 0 1 set_flags DB_TXN_NOSYNC set_lg_bsize 5097152 set_lg_max 50485760

2 1

pcache crashes after 2.4.25 upgrade; complains of unclean shutdowns and missing DB_CONFIGs after every restart
by Tyler Gates 11 Apr '11

11 Apr '11

After upgrading from 2.4.24 to 2.4.25 my pcache overlay using hdb backend first failed to start with messages complaining about a missing suffix. Now that I've added one I'm getting the following message: hdb_db_open: database "dc=example,dc=com": unclean shutdown detected; attempting recovery. hdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14).#012Expect poor performance for suffix "dc=example,dc=com". slapd starting bdb(dc=example,dc=com): PANIC: fatal region error detected; run recovery last message repeated 3 times But DB_CONFIG does exist and has proper permissions and the unclean shutdown message repeats after every restart. I've never had to add the suffix to the pcache backend database before and the documentation examples (http://www.openldap.org/doc/admin24/proxycache.html) never mention it either. Is this a misconfiguration or do I need to file a bug? PCACHE OVERLAY: dn: olcOverlay={0}pcache objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: hdb 100000 3 1000 100 olcPcacheAttrset: 0 uid userPassword uidNumber gidNumber cn homeDirectory logi nShell gecos description memberUid uniqueMember objectClass olcPcacheAttrset: 1 cn automountInformation olcPcacheAttrset: 2 cn mail olcPcacheTemplate: "(|(cn=)(mail=)(sn=))" 2 7200 0 0 0 olcPcacheTemplate: "(&(objectClass=)(|(cn=)(cn=)(cn=)))" 1 3600 600 0 0 olcPcacheTemplate: "(&(objectClass=)(|(cn=)(cn=)))" 1 3600 600 0 0 olcPcacheTemplate: "(&(objectClass=)(|(cn=)(gidNumber=)))" 1 3600 600 0 0 olcPcacheTemplate: "(&(objectClass=)(gidNumber=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(uidNumber=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(uniqueMember=))" 0 1800 900 0 0 olcPcacheTemplate: "(&(objectClass=)(memberUid=))" 0 1800 900 0 0 olcPcacheTemplate: "(objectClass=)" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(cn=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(uid=))" 0 1800 0 0 0 olcPcacheTemplate: "(&(objectClass=)(|(memberUid=)(uniqueMember=)))" 0 1800 0 0 0 olcPcachePosition: tail olcPcacheMaxQueries: 10000 olcPcachePersist: FALSE olcPcacheValidate: FALSE olcPcacheOffline: FALSE HDB backend: dn: olcDatabase={0}hdb objectClass: olcHdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}hdb olcDbDirectory: /var/lib/ldap olcDbCacheSize: 1000 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 3000 olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 createTimestamp: 20110225174535Z olcDbConfig: {0}set_cachesize 0 10485760 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {4}set_lg_max 10485760 olcDbIndex: objectClass eq olcDbIndex: cn eq,subinitial olcDbIndex: uid eq,subinitial olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: userPassword eq olcDbIndex: description eq olcDbIndex: loginShell eq olcDbIndex: homeDirectory eq olcDbIndex: memberUid eq olcDbIndex: gecos eq olcDbIndex: automountInformation eq olcDbIndex: uniqueMember eq olcDbIndex: mail eq,subinitial olcDbIndex: sn eq,subinitial olcDbIndex: givenName eq,subinitial olcDbIndex: member eq olcDbIndex: nisMapName eq olcDbIndex: pcacheQueryID eq olcSuffix: dc=example,dc=com

3 4

help needed for tuning my openldap
by Stéphane PURNELLE 11 Apr '11

11 Apr '11

Hi all, I would like to know how I can tunning my ldap (openldap 2.4.23 on RHEL5.4 64-bits) installation: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ SWAP COMMAND 13480 root 25 0 1378m 18m 4296 S 25.9 0.5 7241:07 1.3g slapd I already read the page http://www.openldap.org/faq/data/cache/1075.html (ex: Number of hash buckets ), but I not have all informations for calculate the size. [root@xxxxxxx openldap-data]# du -h . 43M . My BDB database take only 43M The accesslog take : 62M . How can I reduce memory (swap) usage and CPU usage (sometimes I see 134%) Thank you Stéphane Purnelle ----------------------------------- Stéphane PURNELLE Admin. Systèmes et Réseaux Service Informatique Corman S.A. Tel : 00 32 (0)87/342467

2 5

Renaming of node cause a segfault crash
by Peter Schütt 11 Apr '11

11 Apr '11

Hallo, we use 2.4.19 on RedHat 6.0, 64-Bit, Kernel 2.6.32 When I renamed a node with Apache Directory Studio (e.G. cn=mynode,ou=Groups,dc=mydomain,dc=de) the OpenLDAP-Server crashed. dmesg: slapd[13129]: segfault at 7fd1a9171fb0 ip 00007fd1c47a830f sp 00007fd1a9171fb0 error 6 in slapd[7fd1c46f5000+1f7000] When I restart then the change was successful. In the PastI had a similar error on a self compiled 2.4.23 on a CentOS 5.5, 64-Bit, Kernel 2.6.18: slapd[14668]: segfault at 0000000043a3bed8 rip 000000000047d77f rsp 0000000043a3bed0 error 6 Because of our company policy we prefer to use version from the official repository of our linux distribution. So we change from self compiled 2.4.23 in an old linux to RedHat 6.0 with the "official" OpenLDAP. I try to rename a node by ldapModify to exclude an error in Apache Directory Studio but I do not understand how. Perhaps someone has a hint. Is it possible this an error which is fixed in 2.4.25? Thanks for any hints. Ciao Peter Schütt

2 1

acls for a user to join/leave a group.
by George Mamalakis 11 Apr '11

11 Apr '11

Hello everybody, Is there a way to achieve what the subject says? For example, we can imagine users like: uid=user,ou=people,dc=example,dc=com And the group that I wish the users should be able to join using ldapmodify is: cn=group,dc=example,dc=com. What I wish to achieve is to let a user write in this dn, only the memberOf attribute, by containing only their specific dn. Moreover, the user will have to be able to remove this entry from this group if they wish, using ldapmodify again. Thank you very much for your help in advance, mamalos -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

2 3

ppolicy and simpleSecurityObject exemptions
by Nick Urbanik 09 Apr '11

09 Apr '11

Dear Folks, What is the best/right way to exempt system users (entries that have the simpleSecurityObject objectclass) from the ppolicy default policy? Is it to create another policy without restrictions and specify that each system user should use that policy using pwdPolicySubentry? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

2 1

search ldap
by Noel Akins 09 Apr '11

09 Apr '11

I have a dumb question. I've been struggling with LDAP for a couple of weeks now, working on it at home at night. I seem to have something working here given the ldapsearch i tried doing below. I had started with a base.ldif and added a user via a add_user.ldif. I assume the numEntries: 1 is the user that I entered. But for the life of me, I can't seem to figure out how to view that entry. What do I need to do actually see the entry? Thank you. ldapsearch -L -x -b 'dc=mergeemerge,dc=org' version: 1 # # LDAPv3 # base <dc=mergeemerge,dc=org> with scope subtree # filter: (objectclass=*) # requesting: ALL # # mergeemerge.org dn: dc=mergeemerge,dc=org objectClass: dcObject objectClass: organization o: mergeemerge dc: mergeemerge # search result # numResponses: 2 # numEntries: 1

3 2

Strange log entries
by Peter Schütt 06 Apr '11

06 Apr '11

Hallo, I got the following log entries in /var/log/messages Apr 5 13:19:51 myhost slaptest: auxpropfunc error invalid parameter supplied Apr 5 13:19:51 myhost slapd[18435]: auxpropfunc error invalid parameter supplied This is funny because I redirect the logs of OpenLDAP in an own file by an entry in /etc/rsyslog.conf: # OpenLDAP local4.* /var/log/ldap.log What does these log entries mean? Ciao Peter Schütt

2 2

Speeding up BDB question
by Cannady, Mike 05 Apr '11

05 Apr '11

I have a situation where I need to delete a major branch of my DIT and reload it with a new ldif file on live systems. My current configuration is a two node multi-master running on Red Hat Enterprise 5.4 with openldap 2.22 and BDB 4.8.26. With both masters running, when I delete the branch it takes about 1.5 hours and the reload (ldapadd) takes about 6-7 hours. I've researched the documentation on Berkeley but didn't make any headway to reduce the time. It appeared to me that BDB was doing syncs (lots and lots of disk writes). To test this, I moved the database directory of both masters to a ram drive (mount ramfs) that could hold the whole database directory with room to spare and changed the configuration to use the new location. I reran the tests and the results were that the delete took 6 minutes and the load took about 13 minutes. This is definitely a lot faster and the other master kept up with the updating master. So my question is there anyway to configure Berkeley to come close to this? Is there someway to disable the syncs? Portion of slapd.conf:==================================================== database bdb suffix "dc=htc,dc=com" rootdn "cn=XXXXXXXXXXXXXXXX,dc=htc,dc=com" rootpw XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxxx directory /usr/local/var/openldap-data #directory /var/local/var.ram/openldap-data cachesize 50000 dncachesize 50000 idlcachesize 150000 checkpoint 1024 5 dbnosync dirtyread dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_bsize 2097152 dbconfig set_lg_regionmax 262144 dbconfig set_flags DB_LOG_AUTOREMOVE monitoring on DB_CONFIG:===================================== set_cachesize 0 268435456 1 set_lg_bsize 2097152 set_lg_regionmax 262144 set_flags DB_LOG_AUTOREMOVE set_flags DB_TXN_WRITE_NOSYNC set_flags DB_TXN_NOSYNC Mike Cannady Information Services Horry Telephone Cooperative (HTC) Phone: (843)369-8212 Fax..: (843)369-7195 Pager: (843)828-5899 Email: Mike.Cannady(a)htcinc.net ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

3 6

openLDAP 2.4.25 make fails with TLS errors
by sim123 05 Apr '11

05 Apr '11

I am trying to compile openLDAP 2.4.25 with TLS and cyrusSASL and following these two links http://www.openldap.org/faq/data/cache/196.html http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html configure and make depend works but make fails with very long list of undeclared/undefined errors in TLS. tls_m.c:2994: warning: comparison between pointer and integer tls_m.c:2994: error: 'PR_WOULD_BLOCK_ERROR' undeclared (first use in this function) tls_m.c:2994: warning: comparison between pointer and integer tls_m.c: In function 'tlsm_sb_write': tls_m.c:3016: error: 'struct tls_data' has no member named 'session' tls_m.c:3016: error: 'PR_INTERVAL_NO_TIMEOUT' undeclared (first use in this function) tls_m.c:3019: error: 'PR_PENDING_INTERRUPT_ERROR' undeclared (first use in this function) tls_m.c:3019: warning: comparison between pointer and integer tls_m.c:3019: error: 'PR_WOULD_BLOCK_ERROR' undeclared (first use in this function) tls_m.c:3019: warning: comparison between pointer and integer make[2]: *** [tls_m.lo] Error 1 make[2]: Leaving directory `/root/Desktop/openldap-2.4.25-source/libraries/libldap' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/root/Desktop/openldap-2.4.25-source/libraries' make: *** [all-common] Error 1 [root@100x103 openldap-2.4.25-source]# I am using ./configure --prefix=/root/Desktop/openldap-2.4.25 --with-tls=no --enable-slapd --with-cyrus-sasl --enable-crypt --enable-debug --enable-cleartext to configure on CentOS 5.2 and have cflags and cpppflags defined. Can someone please help me fixing this? Thanks for the help. Thanks, Simon

2 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical