OpenLDAP 2.4.40
Syncrepl configuration:
olcSyncUseSubentry: FALSE
olcSyncrepl: {0}rid=101 provider=ldap://server1 searchbase="o=xxx,dc=yyy, dc=zzz" type=refreshOnly bindmethod=sasl saslmech=EXTERNAL tls_cert=/etc/openldap/certs/xxxxx.crt tls_key=/etc/openldap/certs/xxxxx.key tls_cacert=/etc/openldap/certs/cacert.pem interval=00:00:00:10 retry="5 10 10 10 30 +" timeout=1 starttls=critical olcSyncrepl: {1}rid=102 provider=ldap://server2 searchbase="o=xxx,dc=yyyy, dc=zzz" type=refreshOnly bindmethod=sasl saslmech=EXTERNAL tls_cert=/etc/openldap/certs/ldapadmin.crt tls_key=/etc/openldap/certs/xxxxx.key tls_cacert=/etc/openldap/certs/cacert.pem interval=00:00:00:10 retry="5 10 10 10 30 +" timeout=1 starttls=critical olcMirrorMode: TRUE
BTW, I just tried addinging:
dn: olcOverly={3}syncprov,olcDatabase={2},cn=config
changetype: modify replace: olcSpCheckpoint olcSpCheckpoint: 1024
add: olcSpSessionlog olcSpSessionlog: 1024
add: olcSpReloadhint olcSpReloadhint: TRUE
And that seemed to fix it! Maybe it was just the checkpoint being "1 1" that was messing it up? Or maybe I needed the session log. I realize that this is the deprecated approach. I probably put in cn=changelog instead if there's a good reason to do so.
-Frank
On Tue, Apr 12, 2016 at 6:26 PM, Frank Crow fjcrow2008@gmail.com wrote:
OK, if I do a backup with slapcat, I still would want to wipe the existing contents of the DIT first, right?
Also, I just tried doing a list of deleted uid entries using "ldapdelete -ZZ -f /file.ldif" and although the command did not complain, not all of the entries in the file.ldif were deleted from all replicas. I really think there is something wrong with my configuration! I suppose that I'll try cn=changelog next.
Thanks, Frank
On Tue, Apr 12, 2016 at 5:47 PM, Michael Ströder michael@stroeder.com wrote:
Frank Crow wrote:
I'm trying to create backup and restore scripts using LDAP command line tools.
For various reasons backup and restore should be done with command-line tools slapcat and slapadd which operate directly on the database files.
And yes, with recent backend modules like back-mdb and back-hdb you can do hot backup while slapd is running.
Of course, before a restore you have to stop slapd and remove the DB files. After using slapadd you should check whether ownership/permissions are still correct.
Ciao, Michael.
-- Frank