Hi!
Sorry for this stupid question: One argument for delta-syncrepl is that changing a small part of a large object is much more efficient, because pnly the changed data is logged and transferred. However with a multi-valued attributer like pwdHistory the accesslog entry contains all the unchanged values also. E.g.: … reqMod: pwdHistory:+ 20260207170142Z#1.3.6.1.4.1.1466.115.121.1.40#65#{SSHA256 }i56N/G7DutJ3OWdRXDBlSa/7CFN8XLM9X92RwUWohvQiQIEx+cVu9Q== … reqMod: modifyTimestamp:= 20260207170142Z reqOld: pwdHistory: 20240528115526Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}caF 961AUsh/ECAMdR2i/Iu+DS9Wi22z2 reqOld: pwdHistory: 20240528115715Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}RSu 8pPgFNIuDP/lBK1qylW+z5aEsr9hD reqOld: pwdHistory: 20240902115523Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}B8H FVqRKEheQWDonlsu6cyyMH4SNaQOz reqOld: pwdHistory: 20241018115412Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}9/R BrtPynf5D0cU+R1OGt+ZrdIK4mo0N reqOld: pwdHistory: 20241203075815Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}raC wwHLscnDFG0SwoH9MBbqI2CCfMlzX reqOld: pwdHistory: 20250115093324Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}iMd Qy6jvjwtQQXp5JZmAbLovyFsN1b8J reqOld: pwdHistory: 20250124090328Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}2wQ 4+aXKqOZC1w3uKULFeJ8kleum4Iy6 reqOld: pwdHistory: 20250306085113Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}aXQ 4DutidnaPGBiitGVAMv8Ebb8YMOOc reqOld: pwdHistory: 20250528131341Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}YDh Hw94sp0wdjWu9xzm4DKzpUioi5Wqf reqOld: pwdHistory: 20250822074239Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}Nog FGndg4AiHJEN59Is0JjLgFEx6TQr1 reqOld: pwdHistory: 20250924074514Z#1.3.6.1.4.1.1466.115.121.1.40#65#{SSHA256} lV7mACHa1hPG0RT7EzKM47+EzTz+xamL8+hx72FIG390xyRdnIqkwg== reqOld: pwdHistory: 20250929123923Z#1.3.6.1.4.1.1466.115.121.1.40#65#{SSHA256} kF37AmFjBZFrKeLVjQdemDTi6joE96s4FBhiSqejdSPLdosJVz2YZw== reqOld: pwdHistory: 20251118085003Z#1.3.6.1.4.1.1466.115.121.1.40#65#{SSHA256} f3eB5YSh/xdak80b/eVARKlo/f+vsbD4EbNFv/sfrpbSo2bGfNct6Q==
Doesn’t that “cancel” the gain in efficiency?
Kind regards, Ulrich Windl
Windl, Ulrich wrote:
Hi!
Sorry for this stupid question:
One argument for delta-syncrepl is that changing a small part of a large object is much more efficient, because pnly the changed data is logged and transferred.
However with a multi-valued attributer like pwdHistory the accesslog entry contains all the unchanged values also. E.g.:
You don't need to replicate the reqOld attribute.
Doesn’t that “cancel” the gain in efficiency?
Kind regards,
Ulrich Windl
-----Original Message----- From: Howard Chu hyc@symas.com Sent: Tuesday, February 10, 2026 5:25 PM To: Windl, Ulrich u.windl@ukr.de; openldap-technical@openldap.org Subject: [SUSPICIOUS] [EXT] Re: Stupid question about accesslog, delta- syncrepl and efficiency
Sicherheits-Hinweis: Diese E-Mail wurde von einer Person außerhalb des UKR gesendet. Seien Sie vorsichtig vor gefälschten Absendern, wenn Sie auf Links klicken, Anhänge öffnen oder weitere Aktionen ausführen, bevor Sie die Echtheit überprüft haben.
Windl, Ulrich wrote:
Hi!
Sorry for this stupid question:
One argument for delta-syncrepl is that changing a small part of a large
object is much more efficient, because pnly the changed data is logged and transferred.
However with a multi-valued attributer like pwdHistory the accesslog entry
contains all the unchanged values also. E.g.:
You don't need to replicate the reqOld attribute.
[Windl, Ulrich] I'm not reading the latest admin guide, but maybe there should be a note about accesslog and delta-syncrepl then. I used "olcAccessLogOld: (objectClass=*)" here.
Doesn’t that “cancel” the gain in efficiency?
Kind regards,
Ulrich Windl
-- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
On Wed, Feb 11, 2026 at 08:12:13AM +0000, Windl, Ulrich wrote:
I'm not reading the latest admin guide, but maybe there should be a note about accesslog and delta-syncrepl then. I used "olcAccessLogOld: (objectClass=*)" here.
Hi Ulrich, you told accesslog you are interested in logging the old values of attributes when they change, so it did as you asked.
When it comes to replication, the consumer doesn't actually request this data so it's not transmitted and the documented claim (only changed values are sent) holds. Not sure what the issue is?
Regards,
The issue was that I didn't fully understand the amount of data accesslog will write, and I wasn't sure whether delta-syncrepl needs the old values.
Kind regards, Ulrich Windl
-----Original Message----- From: Ondřej Kuzník ondra@mistotebe.net Sent: Wednesday, February 11, 2026 10:41 AM To: Windl, Ulrich u.windl@ukr.de Cc: Howard Chu hyc@symas.com; openldap-technical@openldap.org Subject: [EXT] Re: [SUSPICIOUS] Re: Stupid question about accesslog, delta- syncrepl and efficiency
On Wed, Feb 11, 2026 at 08:12:13AM +0000, Windl, Ulrich wrote:
I'm not reading the latest admin guide, but maybe there should be a note about accesslog and delta-syncrepl then. I used "olcAccessLogOld: (objectClass=*)" here.
Hi Ulrich, you told accesslog you are interested in logging the old values of attributes when they change, so it did as you asked.
When it comes to replication, the consumer doesn't actually request this data so it's not transmitted and the documented claim (only changed values are sent) holds. Not sure what the issue is?
Regards,
-- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP
openldap-technical@openldap.org
-
Howard Chu -
Ondřej Kuzník -
Windl, Ulrich