Hello,
Sorry, I made a mistake (during sanitize) in my posting. Ldapsearch is looking/starting the search dirctly (-b) in the Container DN with 88000 entires. Only this Container (searchbase) has the objectClass Guest.
So the request is look like:
ldapsearch -x -h localhost -w password -D"cn=admin,ou=root"-b"cn=Bbb,ou=root" "(objectclass=Guest)"
Because of the long time for searching today I moved (ldapmodify -f , moddn) all 88000 entires in an other location (from cn=Bbb,ou=root to cn=Ccc,ou=root)
Example: dn: cn=Aaa,cn=Bbb,ou=root changetype: moddn newrdn: cn=Aaa deleteoldrdn: 1 newSuperior: cn=Ccc,ou=root
and tried the ldapsearch again. The Container "old" is now empty like expected. The result from the displaying immediately (because the container has the objectclass Guest), but the search is continuing and takes a "long" time too.
In the logfile now I can see following error messages from the slapd:
Sep 9 16:25:20 LDAP02 slapd[26832]: bdb_search: 112279 scope not okay Sep 9 16:25:20 LDAP02 slapd[26832]: bdb_search: 112280 scope not okay . . Sep 9 16:25:20 LDAP02 slapd[26832]: bdb_search: 113276 scope not okay Sep 9 16:25:20 LDAP02 slapd[26832]: bdb_search: 113277 scope not okay
Sep 9 16:25:20 LDAP02 slapd[26832]: entry_decode: "cn=Xxx,cn=Ccc,ou=root" Sep 9 16:25:20 LDAP02 slapd[26832]: <= entry_decode(cn=Xxx,cn=Ccc,ou=root) Sep 9 16:25:20 LDAP02 slapd[26832]: bdb_search: 113278 scope not okay . . Sep 9 16:25:29 LDAP02 slapd[26832]: entry_decode: "cn=Zzz,cn=Ccc,ou=root" Sep 9 16:25:29 LDAP02 slapd[26832]: <= entry_decode(cn=Zzz,cn=Ccc,ou=root) Sep 9 16:25:29 LDAP02 slapd[26832]: bdb_search: 154297 scope not okay
Sep 9 16:25:29 LDAP02 slapd[26832]: entry_decode: "cn=Kkk,ou=abc...,... , ou=root" Sep 9 16:25:29 LDAP02 slapd[26832]: <= entry_decode(cn=Kkk,ou=abc...,... , ou=root) Sep 9 16:25:29 LDAP02 slapd[26832]: bdb_search: 154298 scope not okay . . Sep 9 16:26:16 LDAP02 slapd[26832]: entry_decode: "cn=123,ou=xvz...,... , ou=root" Sep 9 16:26:16 LDAP02 slapd[26832]: <= entry_decode(cn=123,ou=xvz...,... , ou=root) Sep 9 16:26:16 LDAP02 slapd[26832]: bdb_search: 355754 scope not okay
I found following Posting in the mailing List with the same message. http://www.openldap.org/lists/openldap-bugs/200410/msg00001.html
What is going wrong?
Thanks Tim
2010/9/9 Howard Chu hyc@symas.com:
tim stone wrote:
Hello,
I've a strange behavior while using index objectClass for searching.
In my slapd.conf I have defined the index in the database section:
index objectClass eq
Other indexes follows in the config. All of them working fine.
If I search via ldapsearch like:
ldapsearch -x -h localhost -w password -D"cn=admin,ou=root" -b"ou=root" "(objectclass=Guest)"
I can find following Message in the syslog (loglevel -1):
Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_equality_candidates (objectClass) Sep 1 14:02:52 LDAP01 slapd[17856]: => key_read Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_index_read: failed (-30989) Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_equality_candidates: id=0, first=0, last=0 Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_filter_candidates: id=0 first=0 last=0 Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_filter_candidates Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_equality_candidates (objectClass) Sep 1 14:02:52 LDAP01 slapd[17856]: => key_read Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_index_read 355545 candidates Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_equality_candidates: id=-1, first=228, last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_filter_candidates: id=-1 first=228 last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_list_candidates: id=-1 first=228 last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_filter_candidates: id=-1 first=228 last=355772 Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_list_candidates: id=-1 first=112277 last=355755 Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_filter_candidates: id=-1 first=112277 last=355755 Sep 1 14:02:52 LDAP01 slapd[17856]: bdb_search_candidates: id=-1 first=112277 last=355755 Sep 1 14:02:52 LDAP01 slapd[17856]: => test_filter Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856]:<= test_filter 5 Sep 1 14:02:52 LDAP01 slapd[17856]: bdb_search: 112277 does not match filter Sep 1 14:02:52 LDAP01 slapd[17856]: entry_decode: "cn=Aaa,cn=Bbb,... Sep 1 14:02:52 LDAP01 slapd[17856]:<= entry_decode(cn=Aaa,cn=Bbb,... Sep 1 14:02:52 LDAP01 slapd[17856]: => bdb_dn2id("cn=aaa,cn=bbb,... Sep 1 14:02:52 LDAP01 slapd[17856]:<= bdb_dn2id: got id=0x1b696 Sep 1 14:02:52 LDAP01 slapd[17856]: => test_filter Sep 1 14:02:52 LDAP01 slapd[17856]: EQUALITY Sep 1 14:02:52 LDAP01 slapd[17856] ... all other entires following...
As result, the entires are found, but not in the index and the search takes a very long time.
The index is working as designed, it's just filled with a lot of false matches which have to be explicitly tested against the filter to be weeded out. The objectclass index provided 355545 candidates in the range of 228 thru 355772. Some other search term provided (355755-112277) candidates, leaving the range from 112277 thru 355755 needing to be tested. If this search takes too long, then you need a larger entry cache.
-- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/