389-users August 2013

389-users@lists.fedoraproject.org

33 participants
35 discussions

Multi-Theading writes to the same 389 Master Server
by Jeffrey Dunham 29 Aug '13

29 Aug '13

We have a customer that has been multi-threading behind multiple servers and writing to our Master server. These writes come in the form of heavy spikes (1k over 5 second intervals) very much burst traffic and all the writes are adding new items to the same ou. While we have plans to throttle them I had a few questions: a) If they're writing to the same ou / updating the same indexes are they blocked on one items success before another succeeds? So in this case multi threading behind multiple boxes does not give them any performance impact. I would guess this is the case, but I want to be sure. Because replication seems to be fine which goes through a single thread iirc. b) are there any performance tweaks that can help? I thought maybe looking at *nsslapd-threadnumber. * -Jeff

5 12

FW: fresh replica reports "reloading ruv failed " just after successfull initialization
by Jovan.VUKOTIC＠sungard.com 29 Aug '13

29 Aug '13

Hi, I would like to link the issue I reported on Saturday with the bug 723937 filed some two years ago. There, just as in my case, dn/entry cache entries have been reported prior to the initialization of master replica. I repeated the replication configuration today, where the multi-master replica that was initialized by other replica having only one entry in userRoot datase prior the initialization( root object) First, two entries were found, then 5... and then 918 (matches the number of entries from the master database) 24/Jun/2013:08:16:03 -0400) - entrycache_clear_int: there are still 2 entries in the entry cache. [24/Jun/2013:08:16:03 -0400) - dncache_clear_int: there are still 2 dn's in the dn cache. :/ [24/Jun/2013:08:16:03 -0400) - WARNNG Import is running with nsslapd-db-private-import-mem on: No other process is allowed to access the database [24/Jun/2013:08:16:07 -04001 - import userRoot: Workers finished: cleaning p... [24/Jun/2013:08:16:07 -0400) - import userRoot: Workers cleaned up. [24/Jun/2013:08:16:07 -0400) - import userRoot: Indexing complete. Post-processing... [24/Jun/2013:08:16:07 -0400) - import userRoot: Generating numSubordinates complete. [24/Jun/2013:08:16:07 -0400) - import userRoot: Flushing caches... [24/Jun/2013:08:16:07 -0400) - import userRoot: Closing files... [24/Jun/2013:08:16:07 -0400) - entrycache_clear_int: there are still 5 entries in the entry cache. [24/Jun/2013:08:16:07 -0400) - dncache_clear-int: there are still 918 dn's in the dn cache. :/ [24/Jun/2013:08:16:07 -0400) - import userRoot: Import complete. Processed 918 entries in 4 seconds. (229.50 entries/sac) [24/Jun/2013:08:16:07 -0400] NSMMReplicationPlugin - multimastar_be_state_change: replica dc:xxxxxx,dc=com is coming on line: enabling replication [24/Jun/2013:08:16:07 -0400] NSMMReplicationPlugin - replica_configure_ruv: failed to create replica ruv tombstone entry (dc=xxxxxx,dc-com): LDAP error - 68 I would like to add that all replicas that could not be configured due to the reported errors were installed on Solaris 10 on Sparc processors, whereas the only replica that was initialized successfully was installed on Solaris 10 on i386 processors. Thanks, Jovan Jovan Vukotić * Senior Software Engineer * Ambit Treasury Management * SunGard * Banking * Bulevar Milutina Milankovića 136b, Belgrade, Serbia * tel: +381.11.6555-66-1 * jovan.vukotic(a)sungard.com<mailto:jovan.vukotic@sungard.com> [Description: Description: Description: Description: Description: coc-signature-03-2012]<http://www.capitalize-on-change.com/?email=70150000000Y1Et> Join the online conversation with SunGard's customers, partners and Industry experts and find an event near you at: www.sungard.com/ten<http://www.capitalize-on-change.com/?email=70150000000Y1Et>. From: Vukotic, Jovan Sent: Saturday, June 22, 2013 11:59 PM To: '389-users(a)lists.fedoraproject.org' Subject: fresh replica reports "reloading ruv failed " just after successfull initialization. Hi, We have four 389 DS, version 1.2.11 that we are organizing in multi-master replication topology. After I enabled all four multi-master replicas and initialized them - from the one, referent replica M1 and Incremental Replication started, it turned out that only two of them are included in replication, the referent M1 and M2 (replication is working in both direction) I tried to fix M3 and M4 in the following way: M3 example: removed replication agreement M1-M3 (M2-M3 did not existed, M4 switched off) After several database restores of pre-replication state and reconfiguration of that replica, I removed 389 DS instance M3 completely and reinstalled it again: remove-ds-admin.pl + setup-ds-admin.pl. I configured TLS/SSL (as before), restarted the DS and enabled replica from 389 Console. Then I returned to M1, recreated the agreement and did initialization of M3. It was successful again, in terms that M3 imported all the data, but immediately after that, to me strange errors were reported: What confuses me is that LDAP 68 means that an entry already exits... even if it is a new replica. Why a tombstone? Or to make the long story short: Is the only remedy to reinstall all four replica again? 22/Jun/2013:16:30:50 - 0400] - All database tnreaas now stopped // this is from a backup done before replication configuration [22/Jun/2013:16:43:25 -0400] NSMMReplicationPlugin - multimaster_be_state_change: replica xxxxxxxxxx is going off line; disablin g replication [22/Jun/2013:16:43:25 -0400] - entrycache_clear_int: there are still 20 entries in the entry cache, [22/Jun/2013:16:43:25 -0400] - dncache_clear_int: there are still 20 dns in the dn cache. :/ [22/Jun/2013:16:43:25 -0400] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access th e database [22/Jun/2013:16:43:30 -0400] - import userRoot: Workers finished; cleaning up.. [22/Jun/2013:16:43:30 -0400] - import userRoot: Workers cleaned up. [22/Jun/2013:16:43:30 -0400] - import userRoot: Indexing complete. Post-processing... [22/Jun/2013:16:43:30 -0400] - import userRoot: Generating numSubordinates complete. [22/Jun/2013:16:43:30 -0400] - import userRoot: Flushing caches. [22/Jun/2013:16:43:30 -0400] - import userRoot: Closing files. [22/Jun/2013:16:43:30 -0400] - entrycache_clear_int: there are still 20 entries in the entry cache. [22/Jun/2013:16:43:30 -0400] - dncache_clear_int: there are still 917 dn's in the dn cache. :/ [22/Jun/2013:16:43:30 -0400] - import userRoot: Import complete. Processed 917 entries in 4 seconds, (229.25 entries/sec) [22/Jun/2013:16:43:30 -0400] NSMMRep1 icationPlugin - multimaster_be_state_change: replica xxxxxxxxxxx is coming online; enabling replication [22/Jun/2013:16:43:30 -0400] NSMMReplicationPlugin - replica_configure_ruv: failed to create replica ruy tombstone entry (xxxxxxxxxx); LDAP error - 68 [22/Jun/2013:16:43:30 -0400] NSMMReplicationPlugin - replica_enable_replication: reloading ruv failed [22/Jun/2013:16:43:32 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68 [22/Jun/2013:16:44:02 -0400] NSMMReplicationPlugin - replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxxx); LDAP error - 68 [22/Jun/2013:16:44:32 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68 [22/Jun/2013:16:45:02 -0400] NSMMReplicationPluyin - _replica_confiyure_ruv: failed to create replica ruv tombstone entry (xxxxxxxx); LDAP error - 68 [22/Jun/2013:16:45:32 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68 [22/Jun/2013:16:46:02 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68 Any help will be appreciated. Thank you. Jovan Vukotić * Senior Software Engineer * Ambit Treasury Management * SunGard * Banking * Bulevar Milutina Milankovića 136b, Belgrade, Serbia * tel: +381.11.6555-66-1 * jovan.vukotic(a)sungard.com<mailto:jovan.vukotic@sungard.com> [Description: Description: Description: Description: Description: coc-signature-03-2012]<http://www.capitalize-on-change.com/?email=70150000000Y1Et> Join the online conversation with SunGard's customers, partners and Industry experts and find an event near you at: www.sungard.com/ten<http://www.capitalize-on-change.com/?email=70150000000Y1Et>.

2 9

Install Fedora from its source code using virtual box
by Maryyam Muhammad Din 29 Aug '13

29 Aug '13

Hello, Can anyone please guide me how can i compile Fedora from its source code by using some kind of virtual machine. Actually i want to trace some signals; especially termination signals SIGTERMSIGINT and SIGKILL. Currently i am using fedora 19 and i want to install second operating system on virtual machine (to edit and recompile its code) Thank You -- Maryyam Muhammad Din Al-Khawarizmi Institute of Computer Science UET Lahore

1 0

passwordWarned and passwordExpirationTime
by Iain Morgan 27 Aug '13

27 Aug '13

Hello, As I understand it, if a user authenticates to the LDAP server within passwordWarning seconds of passwordExpirationTime and passwordExpWarned is not set, the passwordExpirationTime attribute will automatically be increased to ensure that the user has sufficient warning time. Is this correct? I would like to have passwordWarning set so that users have the opportunity of being warned prior to password expiration, but due to local policy I don't want passwordExpirationTime to be increased. Thus, I'm willing to accept that in some cases users may a shorter warning period, or not warning at all. Unfortunately, I don't see a way of doing this. Is there a way to disable the automatic adjustment of passwordExpirationTime? I've tried using a CoS to set passwordExpWarned, but that did not appear to work. I expect that I could write a plugin to set passwordExpWarned right after the password has been changed, but that seems like a reasonable bit of work. Any suggestions? Thanks, -- Iain Morgan

1 0

problems with password policies
by Morgan Jones 27 Aug '13

27 Aug '13

Either I'm missing something or password policies just don't work in Redhat (CentOS) directory 8.2.8. I started by creating a subtree policy on the command line: # ./ns-newpwpolicy.pl -D cn=directory\ manager -w pass -h localhost -S ou=students,dc=domain,dc=org adding new entry cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org adding new entry cn=cn=nsPwPolicyEntry\,ou=students\,dc=domain\,dc=org,cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org adding new entry cn=cn=nsPwTemplateEntry\,ou=students\,dc=domain\,dc=org,cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org adding new entry cn=nsPwPolicy_cos,ou=students,dc=domain,dc=org modifying entry cn=config The following were created: dn: cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org objectClass: top objectClass: nsContainer cn: nsPwPolicyContainer dn: cn=cn=nsPwTemplateEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn=nsPwPolicyC ontainer,ou=students,dc=domain,dc=org objectClass: top objectClass: extensibleObject objectClass: costemplate objectClass: ldapsubentry cosPriority: 1 cn: cn=nsPwTemplateEntry,ou=students,dc=domain,dc=org dn: cn=nsPwPolicy_cos,ou=students,dc=domain,dc=org objectClass: top objectClass: LDAPsubentry objectClass: cosSuperDefinition objectClass: cosPointerDefinition costemplatedn: cn=cn=nsPwTemplateEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn= nsPwPolicyContainer,ou=students,dc=domain,dc=org cosAttribute: pwdpolicysubentry default operational-default cn: nsPwPolicy_cos dn: cn=cn=nsPwPolicyEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn=nsPwPolicyCon tainer,ou=students,dc=domain,dc=org objectClass: top objectClass: ldapsubentry objectClass: passwordpolicy cn: cn=nsPwPolicyEntry,ou=students,dc=domain,dc=org I added the policy attributes we're interested in: dn: cn=cn=nsPwPolicyEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn=nsPwPolicyCon tainer,ou=students,dc=domain,dc=org passwordResetFailureCount: 600 passwordMaxFailure: 10 passwordLockout: on passwordMinLength: 6 objectClass: top objectClass: ldapsubentry objectClass: passwordpolicy cn: cn=nsPwPolicyEntry,ou=students,dc=domain,dc=org I then tried 11 ldapsearches as a user under ou=students,dc=domain,dc=org and the account was not locked out. I then checked the console and the settings weren't there. I set them and it added two additional entries: dn: cn=cn\3DnsPwPolicyEntry\2Cou\3Dstudents\2Cdc\3Ddomain\2Cdc\3Dorg,cn=nsPwP olicyContainer,ou=students,dc=domain,dc=org passwordMaxFailure: 10 passwordResetFailureCount: 600 passwordLockout: on passwordStorageScheme: ssha passwordCheckSyntax: on passwordChange: off passwordMinAge: 0 passwordExp: off passwordMustChange: off passwordMinLength: 6 objectClass: ldapsubentry objectClass: passwordpolicy objectClass: top cn: cn=nsPwPolicyEntry,ou=students,dc=domain,dc=org dn: cn=cn\3DnsPwTemplateEntry\2Cou\3Dstudents\2Cdc\3Ddomain\2Cdc\3Dorg,cn=nsP wPolicyContainer,ou=students,dc=domain,dc=org objectClass: extensibleObject objectClass: costemplate objectClass: ldapsubentry objectClass: top cosPriority: 1 cn: cn=nsPwTemplateEntry,ou=students,dc=domain,dc=org However I still can't force a user to be locked out. I did set passwordIsGlobalPolicy to on under cn=config though as far as I can tell that only affects replication of password policies. Am I missing something? thanks, -morgan

2 3

Problems setting up MMR
by Louis Bohm 22 Aug '13

22 Aug '13

I have 2 servers running cents 6.4 and the newest version of DS from the repos. Both serves have the same supplier DN. On the second server (ldap02) I go no errors when setting up the replication agreement. However, on the first server (ldap01) I got "LDAP error: No such object. Error code: 32". The logs on ldap02 show this: [22/Aug/2013:15:14:17 -0400] conn=48 fd=71 slot=71 connection from 10.74.192.51 to 10.74.192.52 [22/Aug/2013:15:14:17 -0400] conn=48 op=0 BIND dn="cn=replication manager,cn=config" method=128 version=3 [22/Aug/2013:15:14:17 -0400] conn=48 op=0 RESULT err=32 tag=97 nentries=0 etime=0 [22/Aug/2013:15:14:17 -0400] conn=48 op=1 UNBIND [22/Aug/2013:15:14:17 -0400] conn=48 op=1 fd=71 closed - U1 I guess the first thing I need to do is prove that supplier DN is really there and is the same. But I have been unable to come up with an ldapsearch that shows it. Or is the only way to see it is to grep the dse.ldif file? Louis

2 5

Best way to upgrade DS servers
by Chris Taylor 22 Aug '13

22 Aug '13

I am looking at replacing our two CentOS DS servers which are 5.9 with some on the 6.4 channel. What is the best way to transition all the data over? Should I build them separately and import everything via ldif files, or can I add them as consumers or in our setup as another master in our MMR setup. To add a little complexity I have also added some RADIUS attributes to the schema so I am assuming that, those will need to be added before I setup any replication. Any advice would be great. Thanks, Chris

3 6

Replication Manager DN wrong
by Louis Bohm 22 Aug '13

22 Aug '13

Following the directions for setting up a supplier dn for replication I created a file with the following: [root@ldap01 slapd-ldap01]# cat /root/supplier.ldif dn: cn=replication manager,cn=config objectClass: inetorgperson objectClass: person objectClass: top cn: replication manager sn: RM userPassword: XXXXXXXXX passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 And then I did cat /root/supplier.ldif >> /etc/dirsrv/slapd-ldap01/dse.ldif and then restarted dirsrv. When I do that I see the following. Shutting down dirsrv: ldap01... [ OK ] Starting dirsrv: ldap01...[22/Aug/2013:10:22:04 -0400] - Entry "cn=replication manager,cn=config" has unknown object class "inetorgperson " (remove the trailing space) [22/Aug/2013:10:22:04 -0400] - Entry "cn=replication manager,cn=config" has unknown object class "person " (remove the trailing space) [22/Aug/2013:10:22:04 -0400] - Entry "cn=replication manager,cn=config" has unknown object class "top " (remove the trailing space) [ OK ] How do I delete the entry or fix the entry? I tried to use ldapdelete to delete it but no luck. ldapdelete -p 389 -h ldap01.us2.example.com -w XXXXX -D -D "cn=directory manager" "cn=replication manager,cn=config" Thanks, Louis

2 2

Attribute value ordering
by Mitja Mihelič 22 Aug '13

22 Aug '13

Hi! Out DIT holds user entries that have multiple "mail" attributes (main email, aliases). Here is an example entry: dn: eduPersonPrincipalName=user(a)example.com,dc=example,dc=com mail: nickname(a)example.com mail: user(a)example.com mail: user.name(a)example.com Our application (e.g. WordPress) authenticates against the 389DS and also pull some additional attributes, needed by the application. In this case the email address. The application picks up the first mail attribute received and uses it as the user's email. In this case would be "nickname(a)example.com", which is unwanted. The desired outcome would be the "user.name(a)example.com" displayed as first. By what algorithm/logic do the attributes get sorted? Time added perhaps? Is there any way of influencing this sorting? We were also thinking of putting the "main" email into another attribute. Which attribute would be appropriate for something like this? Regards, Mitja -- -- Mitja Mihelič ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia tel: +386 1 479 8877, fax: +386 1 479 88 78

3 5

Random crashes under heavy load
by Mahadevan, Venkat 21 Aug '13

21 Aug '13

Hello, I am running 389 DS 1.2.11.15-20 under RHEL 6.4. When the server is subjected to heavy loads (many adds and modifies, or many deletes), it will randomly crash. A manual restart is then required which generates the following message: [21/Aug/2013:12:30:56 -0700] - Detected Disorderly Shutdown last time Directory Server was running, recovering database. The server then takes a while to restart but eventually comes back up. I was wondering if the cause of this was related to the following bug: https://fedorahosted.org/389/ticket/47349 Would this assumption be accurate? Thanks. cheers, Ven

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2013