a bit of additional data which may be relevant:
the consumer synrepl config:
{0}rid=0 provider=ldap://dsa.example.net starttls=critical bindmethod=simple binddn="cn=repl- content,ou=exo,ou=services,ou=accounts,dc=example,dc=net" credentials="xxxxx" searchbase="dc=example,dc=net" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="15 +" syncdata=accesslog
using ldapsearch on the consumer, against the provider, the replication dn is able to see the entry in question:
ldapsearch -xLLLZZH 'ldap://dsa.example.net' -D 'cn=repl-content,ou=exo,ou=services,ou=accounts,dc=example,dc=net' -w 'xxxxx' -b 'cn=test_group,ou=general,ou=groups,dc=example,dc=net' -s base '*' '+'
dn: cn=test_group,ou=general,ou=groups,dc=example,dc=net objectClass: top objectClass: groupOfNames description: test group cn: test_group member: uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example, dc=net structuralObjectClass: groupOfNames entryUUID: d68c73e4-10c1-1031-8246-9dfa8daa46e0 creatorsName: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net createTimestamp: 20120402034404Z entryCSN: 20120402034404.808333Z#000000#000#000000 modifiersName: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net modifyTimestamp: 20120402034404Z entryDN: cn=test_group,ou=general,ou=groups,dc=example,dc=net subschemaSubentry: cn=Subschema hasSubordinates: FALSE