Hi,<div>I&#39;m trying to migrate from OpenLDAP 2.3.43-12.el5_6.7 to OpenLDAP 2.4.23-20.el6.x86_6.</div><div>In 2.3, we currently have one master, replicating changes to 2 consumers via slurpd.</div><div><br></div><div>I&#39;m trying to configure 2.4 w/ syncrepl, and have tried using refreshAndPersist to mimic that same routine</div>

<div>of pushing changes from the master.  I&#39;m getting failures though:</div><div><br></div><div>on the master:</div><div><br></div><div><div>ay 25 13:55:25  slapd[6855]: send_search_entry: conn 1064  ber write failed.</div>

<div>May 25 13:55:45 slapd[6855]: send_search_entry: conn 1066  ber write failed.</div><div>May 25 13:56:45  slapd[6855]: send_search_entry: conn 1068  ber write failed.</div><div>May 25 13:57:45 slapd[6855]: send_search_entry: conn 1078  ber write failed.</div>

<div>May 25 13:58:45 slapd[6855]: send_search_entry: conn 1084  ber write failed.</div><div>May 25 13:59:05 slapd[6855]: send_search_entry: conn 1086  ber write failed.</div><div>May 25 13:59:15 slapd[6855]: send_search_entry: conn 1087  ber write failed.</div>

<div><br></div></div><div>on a consumer:</div><div><div>May 25 13:45:15 slapd[28707]: do_syncrepl: rid=002 rc 68 retrying (9 retries left)</div><div>May 25 13:45:25 slapd[28707]: syncrepl_entry: rid=002 be_add cn=XXXXXXX,dc=edu failed (68)</div>

<div><br></div><div><br></div><div>here are snippets from the master&#39;s slapd.conf and from one of the consumers:</div><div><br></div><div><div>master -</div><div>-------</div><div><br></div><div>database<span class="Apple-tab-span" style="white-space:pre">	</span>hdb</div>

<div>include /etc/openldap/slapd.access</div><div>suffix<span class="Apple-tab-span" style="white-space:pre">		</span>&quot;dc=XXXXdc=edu&quot;</div><div>checkpoint      1024    5</div><div>cachesize       30000</div><div>

idlcachesize<span class="Apple-tab-span" style="white-space:pre">	</span>90000</div><div>rootdn<span class="Apple-tab-span" style="white-space:pre">		</span>&quot;cn=Manager,XXXXX,dc=edu&quot;</div><div># NOTE: &quot;updatedn&quot; MUST BE COMMENTED OUT FOR INITIAL CREATION/LOAD OF</div>

<div># ROOT INFO</div><div><br></div><div><br></div><div><br></div><div>overlay syncprov</div><div>syncprov-checkpoint 100 10</div><div>syncprov-sessionlog 100</div><div><br></div><div><br></div><div># Cleartext passwords, especially for the rootdn, should</div>

<div># be avoid.  See slappasswd(8) and slapd.conf(5) for details.</div><div># Use of strong authentication encouraged.</div><div>#rootpw<span class="Apple-tab-span" style="white-space:pre">		</span>secret</div><div># needs to be changed to something someone knows.</div>

<div>rootpw          secret</div><div># The database directory MUST exist prior to running slapd AND </div><div># should only be accessible by the slapd and slap tools.</div><div># Mode 700 recommended.</div><div>directory<span class="Apple-tab-span" style="white-space:pre">	</span>/var/lib/ldap</div>

<div># Indices to maintain</div><div># review these</div><div>index default pres,eq</div><div>index uid eq,sub</div><div>index entryUUID,entryCSN</div><div>index cn,sn,givenName,ou,mail,telephoneNumber pres,eq,sub</div><div>

index employeeNumber,mailAlternateAddress,eduPersonPrincipalName</div><div>index eduPersonAffiliation,eduPersonPrimaryAffiliation</div><div>index objectClass,serialNumber eq</div><div>index isMemberOf eq,subany</div><div>

TLSCertificateFile /etc/openldap/newcert.pem</div><div>TLSCertificateKeyFile /etc/openldap/newkey.pem</div><div>TLSCACertificateFile /etc/openldap/chain.pem</div></div><div><br></div><div><br></div><div>consumer -</div><div>

------------------</div><div><div>database<span class="Apple-tab-span" style="white-space:pre">	</span>hdb</div><div>suffix<span class="Apple-tab-span" style="white-space:pre">		</span>&quot;dc=XXXXX=edu&quot;</div><div>
checkpoint      1024    5</div>
<div>cachesize       30000</div><div>idlcachesize<span class="Apple-tab-span" style="white-space:pre">	</span>90000</div><div>rootdn<span class="Apple-tab-span" style="white-space:pre">		</span>&quot;cn=Manager,dc=XXXX,dc=edu&quot;</div>

<div># NOTE: &quot;updatedn&quot; MUST BE COMMENTED OUT FOR INITIAL CREATION/LOAD OF</div><div># ROOT INFO</div><div><br></div><div># Cleartext passwords, especially for the rootdn, should</div><div># be avoid.  See slappasswd(8) and slapd.conf(5) for details.</div>

<div># Use of strong authentication encouraged.</div><div>#rootpw<span class="Apple-tab-span" style="white-space:pre">		</span>secret</div><div># needs to be changed to something someone knows.</div><div>rootpw          secret</div>

<div># The database directory MUST exist prior to running slapd AND </div><div># should only be accessible by the slapd and slap tools.</div><div># Mode 700 recommended.</div><div>directory<span class="Apple-tab-span" style="white-space:pre">	</span>/var/lib/ldap</div>

<div># Indices to maintain</div><div># review these</div><div>index default pres,eq</div><div>index uid eq,sub</div><div>index entryUUID,entryCSN</div><div>index cn,sn,givenName,ou,mail,telephoneNumber pres,eq,sub</div><div>

index employeeNumber,mailAlternateAddress,eduPersonPrincipalName</div><div>index eduPersonAffiliation,eduPersonPrimaryAffiliation</div><div>index objectClass,serialNumber eq</div><div>index isMemberOf eq,subany</div><div>

TLSCertificateFile /etc/openldap/newcert.pem</div><div>TLSCertificateKeyFile /etc/openldap/newkey.pem</div><div>TLSCACertificateFile /etc/openldap/chain.pem</div><div><br></div><div><br></div><div><br></div><div>syncrepl rid=002</div>

<div><span class="Apple-tab-span" style="white-space:pre">	</span>provider=ldap://providername-taken-out-here:389</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>type=refreshAndPersist</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>retry=&quot;10 10 60 +&quot;</div>

<div><span class="Apple-tab-span" style="white-space:pre">	</span>searchbase=&quot;dc=XXXX,dc=edu&quot;</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>filter=&quot;(objectClass=*)&quot;</div><div>
<span class="Apple-tab-span" style="white-space:pre">	</span>attrs=&quot;*&quot;</div>
<div><span class="Apple-tab-span" style="white-space:pre">	</span>scope=sub</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>schemachecking=off</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>bindmethod=simple</div>

<div><span class="Apple-tab-span" style="white-space:pre">	</span>binddn=&quot;cn=Replicator,dc=XXXX,dc=edu&quot;</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>credentials=&quot;password&quot;</div>

<div><br></div><div>updateref ldap://providername-takenout-here:389</div></div><div><br></div><div><br></div><div><br></div><div><br></div><div>the account I&quot;m using to bind from the consumer has read access to everything on the master.</div>

<div>Thanks in advance</div><div><br></div><div><br></div><div><br></div></div>