Hi.

My company has decided to migrate from Oracle Directory Server 7.0 (ODSEE ) to OpenLDAP due to end of life supportability issues .

I’ve installed the RHEL 6.9 OpenLDAP bundled product and have a working suffix based on cn=config vs. slapd.conf  model but cannot get the accesslog overlays/DB’s to work  properly (ldapsearch returns accesslog records but never completes and instead hangs showing “ldap_int_select” . Need to ctl –c to exit )

Here’s the details:

-              more /etc/redhat-release

o             Red Hat Enterprise Linux Server release 6.9 (Santiago)

-              yum list installed | grep openldap

o             compat-openldap.x86_64            1:2.3.43-2.el6           

o             openldap.x86_64                   2.4.40-16.el6           

o             openldap-clients.x86_64           2.4.40-16.el6           

o             openldap-devel.x86_64             2.4.40-16.el6           

o             openldap-servers.x86_64           2.4.40-16.el6  

-              ldapsearch -Q -Y EXTERNAL -H ldapi:/// -LLL -b "olcDatabase={2}bdb,cn=config" | egrep "olcRo|olcSu" < - -------- main suffix DB

o             olcSuffix: dc=mydomain,dc=ca

o             olcRootDN: cn=dev13,dc=mydomain,dc=ca

o             olcRootPW: {SSHA}ZODaH7MZuRjuG+FTzIZvdPg5edL2WDjg

-              ldapsearch -Q -Y EXTERNAL -H ldapi:/// -LLL -b "olcDatabase={3}bdb,cn=config" < - ---accesslog DB and overlay

o             dn: olcDatabase={3}bdb,cn=config

o             objectClass: olcDatabaseConfig

o             objectClass: olcBdbConfig

o             olcDatabase: {3}bdb

o             olcDbDirectory: /var/lib/ldap/accesslog

o             olcSuffix: cn=accesslog

o             olcRootDN: cn=dev13,dc=mydomain,dc=ca

o             olcDbIndex: default eq

o             olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart

-             

o             dn: olcOverlay={0}accesslog,olcDatabase={3}bdb,cn=config

o             objectClass: olcOverlayConfig

o             objectClass: olcAccessLogConfig

o             olcOverlay: {0}accesslog

o             olcAccessLogDB: cn=accesslog

o             olcAccessLogOps: writes reads session

o             olcAccessLogPurge: 07+00:00 01+00:00

o             olcAccessLogSuccess: TRUE

-              ldapsearch -Q -Y EXTERNAL -H ldapi:/// -LLL -b "cn=module{0},cn=config" |< - --------------loaded  modules

o             dn: cn=module{0},cn=config

o             objectClass: olcModuleList

o             cn: module{0}

o             olcModulePath: /usr/lib64/openldap

o             olcModuleLoad: {0}syncprov.la

o             olcModuleLoad: {1}accesslog.la

When I execute the ldapsearch on cn=accesslog I get the following ( ctl-c needed to exit from the hang ) :

ldapsearch -d 1 -H ldap:// -v -x -LLL -D "cn=dev13,dc=mailposte,dc=ca" -b cn=accesslog -W

ldap_url_parse_ext(ldap://)

ldap_initialize( ldap://:389/??base )

ldap_create

ldap_url_parse_ext(ldap://:389/??base)

Enter LDAP Password:

… stuff omitted due to length  …

reqDN: reqStart=20170620210816.000003Z,cn=accesslog

ldap_get_attribute_ber

ber_scanf fmt ({mM}) ber:

reqResult: 0

ldap_get_attribute_ber

ber_scanf fmt ({mM}) ber:

reqMod: objectClass:+ auditSearch

reqMod: structuralObjectClass:+ auditSearch

reqMod: reqStart:+ 20170620210816.000003Z

reqMod: reqEnd:+ 20170620210816.000004Z

reqMod: reqType:+ search

reqMod: reqSession:+ 18446744073709551615

reqMod: reqAuthzID:+ cn=dev13,dc=mailposte,dc=ca

reqMod: reqDN:+ cn=accesslog

reqMod: reqResult:+ 0

reqMod: reqScope:+ one

reqMod: reqDerefAliases:+ never

reqMod: reqAttrsOnly:+ TRUE

reqMod: reqFilter:+ (reqStart<=20170613210816Z)

reqMod: reqAttr:+ 1.1

reqMod: reqEntries:+ 0

reqMod: reqTimeLimit:+ -1

reqMod: reqSizeLimit:+ -1

reqMod: entryUUID:+ 52bef5ee-ea48-1036-9807-2fa6ad6fded4

reqMod: creatorsName:+ cn=dev13,dc=mailposte,dc=ca

reqMod: createTimestamp:+ 20170620210816Z

reqMod: entryCSN:+ 20170620210816.416676Z#000000#000#000000

reqMod: modifiersName:+ cn=dev13,dc=mailposte,dc=ca

reqMod: modifyTimestamp:+ 20170620210816Z

ldap_get_attribute_ber

ber_scanf fmt ({mM}) ber:

reqEntryUUID: 52bef5ee-ea48-1036-9807-2fa6ad6fded4

ldap_get_attribute_ber

ldap_msgfree

ldap_result ld 0x14c91c0 msgid -1

wait4msg ld 0x14c91c0 msgid -1 (infinite timeout)

wait4msg continue ld 0x14c91c0 msgid -1 all 0

** ld 0x14c91c0 Connections:

* host: (null)  port: 389  (default)

  refcnt: 2  status: Connected

  last used: Wed Jun 21 13:46:58 2017

** ld 0x14c91c0 Outstanding Requests:

* msgid 2,  origid 2, status InProgress

   outstanding referrals 0, parent count 0

  ld 0x14c91c0 request count 1 (abandoned 0)

** ld 0x14c91c0 Response Queue:

   Empty

  ld 0x14c91c0 response count 0

ldap_chkResponseList ld 0x14c91c0 msgid -1 all 0

ldap_chkResponseList returns ld 0x14c91c0 NULL

ldap_int_select

^C

When I do an strace of  the working suffix ( dc=mydomain,dc=ca )  I get the following  termination :

-              strace ldapsearch -d 1 -H ldap:// -v -x -LLL -D "cn=dev13,dc=mydomain,dc=ca" -b dc=mydomain,dc=ca -w my_passwd

….. stuff omitted due to length ….

write(3, "0\5\2\1\3B\0", 7)             = 7

shutdown(3, SHUT_RDWR)                  = 0

close(3)                                = 0

write(2, "ldap_free_connection: actually f"..., 37ldap_free_connection: actually freed

) = 37

exit_group(0)                           = ?

+++ exited with 0 +++

When I do an strace of  cn=accesslog   I get the following  termination :

-              strace ldapsearch -d 1 -H ldap:// -v -x -LLL -D "cn=dev13,dc=mydomain,dc=ca" -b cn=accesslog -w my_passwd

….. stuff omitted due to length ….

write(1, "reqEntryUUID: 52bef5ee-ea48-1036"..., 51reqEntryUUID: 52bef5ee-ea48-1036-9807-2fa6ad6fded4) = 51

write(2, "ldap_get_attribute_ber\n", 23ldap_get_attribute_ber) = 23

write(2, "ldap_msgfree\n", 13ldap_msgfree)          = 13

write(2, "ldap_result ld 0x24381e0 msgid -"..., 34ldap_result ld 0x24381e0 msgid -1) = 34

write(2, "wait4msg ld 0x24381e0 msgid -1 ("..., 50wait4msg ld 0x24381e0 msgid -1 (infinite timeout)) = 50

write(2, "wait4msg continue ld 0x24381e0 m"..., 46wait4msg continue ld 0x24381e0 msgid -1 all 0) = 46

write(2, "** ld 0x24381e0 Connections:\n", 29** ld 0x24381e0 Connections:) = 29

write(2, "* host: (null)  port: 389  (defa"..., 37* host: (null)  port: 389  (default)) = 37

write(2, "  refcnt: 2  status: Connected\n", 31  refcnt: 2  status: Connected) = 31

stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3477, ...}) = 0

write(2, "  last used: Wed Jun 21 14:07:30"..., 39  last used: Wed Jun 21 14:07:30 2017) = 39

write(2, "\n", 1)                       = 1

write(2, "** ld 0x24381e0 Outstanding Requ"..., 38** ld 0x24381e0 Outstanding Requests:) = 38

write(2, " * msgid 2,  origid 2, status In"..., 41 * msgid 2,  origid 2, status InProgress) = 41

write(2, "   outstanding referrals 0, pare"..., 43   outstanding referrals 0, parent count 0) = 43

write(2, "  ld 0x24381e0 request count 1 ("..., 45  ld 0x24381e0 request count 1 (abandoned 0)) = 45

write(2, "** ld 0x24381e0 Response Queue:\n", 32** ld 0x24381e0 Response Queue:) = 32

write(2, "   Empty\n", 9   Empty)               = 9

write(2, "  ld 0x24381e0 response count 0\n", 32  ld 0x24381e0 response count 0) = 32

write(2, "ldap_chkResponseList ld 0x24381e"..., 49ldap_chkResponseList ld 0x24381e0 msgid -1 all 0) = 49

write(2, "ldap_chkResponseList returns ld "..., 47ldap_chkResponseList returns ld 0x24381e0 NULL) = 47

write(2, "ldap_int_select\n", 16ldap_int_select)       = 16

poll([{fd=3, events=POLLIN|POLLPRI}], 1, -1 < - ------------------------------- This means poll is  waiting for something on this File descriptor which never gets returned

^C

Process 7844 detached

<detached ...>

Here is  the ldif file used for moduleload by  ldapadd  :

cat addModule.ldif

dn: cn=module{0},cn=config

objectClass: olcModuleList

cn: module{0}

olcModulePath: /usr/lib64/openldap

#olcModuleLoad: {0}back_bdb

olcModuleLoad: syncprov.la

olcModuleLoad: accesslog.la

Here is  the ldif file to add the accesslog db and overlay by  ldapadd:

cat addAccesslog2DB

# Accesslog database definitions

dn: olcDatabase={3}bdb,cn=config

objectClass: olcDatabaseConfig

objectClass: olcBdbConfig

olcDatabase: {3}bdb

olcDbDirectory: /var/lib/ldap/accesslog

olcSuffix: cn=accesslog

olcRootDN: cn=dev13,dc=mydomain,dc=ca

olcDbIndex: default eq

olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart

# accesslog overlay definitions for primary db

dn: olcOverlay=accesslog,olcDatabase={3}bdb,cn=config

objectClass: olcOverlayConfig

objectClass: olcAccessLogConfig

olcOverlay: accesslog

olcAccessLogDB: cn=accesslog

olcAccessLogOps: writes reads session

olcAccessLogSuccess: TRUE

# scan the accesslog DB every day and purge entries older than 7 days

olcAccessLogPurge: 07+00:00 01+00:00

I have also  created /var/lib/ldap/accesslog owned by  ldap:ldap :

ls -l /var/lib/ldap/accesslog

total 11232

-rw-r-----. 1 ldap ldap     4096 Jun 20 17:08 alock

-rw-------. 1 ldap ldap    24576 Jun 20 17:08 __db.001

-rw-------. 1 ldap ldap   188416 Jun 21 14:07 __db.002

-rw-------. 1 ldap ldap   270336 Jun 21 13:46 __db.003

-rw-------. 1 ldap ldap    98304 Jun 21 13:46 __db.004

-rw-------. 1 ldap ldap   753664 Jun 21 14:07 __db.005

-rw-------. 1 ldap ldap    32768 Jun 21 14:07 __db.006

-rw-------. 1 ldap ldap     8192 Jun 20 17:08 dn2id.bdb

-rw-------. 1 ldap ldap     8192 Jun 20 17:08 entryCSN.bdb

-rw-------. 1 ldap ldap    32768 Jun 20 17:08 id2entry.bdb

-rw-------. 1 ldap ldap 10485760 Jun 20 17:08 log.0000000001

-rw-------. 1 ldap ldap     8192 Jun 20 17:08 objectClass.bdb

-rw-------. 1 ldap ldap     8192 Jun 20 17:08 reqEnd.bdb

-rw-------. 1 ldap ldap     8192 Jun 20 17:08 reqResult.bdb

-rw-------. 1 ldap ldap     8192 Jun 20 17:08 reqStart.bdb

I am new to this forum so If I’ve missed something please let me know.  Constructive comments and suggestions are greatly appreciated.

regards

RON LAMARCHE

Technical Specialist, Online Channel

Innovapost