Multi-Theading writes to the same 389 Master Server
by Jeffrey Dunham
We have a customer that has been multi-threading behind multiple servers
and writing to our Master server. These writes come in the form of heavy
spikes (1k over 5 second intervals) very much burst traffic and all the
writes are adding new items to the same ou. While we have plans to
throttle them I had a few questions:
a) If they're writing to the same ou / updating the same indexes are they
blocked on one items success before another succeeds? So in this case
multi threading behind multiple boxes does not give them any performance
impact. I would guess this is the case, but I want to be sure. Because
replication seems to be fine which goes through a single thread iirc.
b) are there any performance tweaks that can help? I thought maybe looking
at *nsslapd-threadnumber.
*
-Jeff
10 years, 7 months
FW: fresh replica reports "reloading ruv failed " just after successfull initialization
by Jovan.VUKOTIC@sungard.com
Hi,
I would like to link the issue I reported on Saturday with the bug 723937 filed some two years ago.
There, just as in my case, dn/entry cache entries have been reported prior to the initialization of master replica.
I repeated the replication configuration today, where the multi-master replica that was initialized by other replica having only one entry in userRoot datase prior the initialization( root object)
First, two entries were found, then 5... and then 918 (matches the number of entries from the master database)
24/Jun/2013:08:16:03 -0400) - entrycache_clear_int: there are still 2 entries in the entry cache.
[24/Jun/2013:08:16:03 -0400) - dncache_clear_int: there are still 2 dn's in the dn cache. :/
[24/Jun/2013:08:16:03 -0400) - WARNNG Import is running with nsslapd-db-private-import-mem on: No other process is allowed to access the database
[24/Jun/2013:08:16:07 -04001 - import userRoot: Workers finished: cleaning p...
[24/Jun/2013:08:16:07 -0400) - import userRoot: Workers cleaned up.
[24/Jun/2013:08:16:07 -0400) - import userRoot: Indexing complete. Post-processing...
[24/Jun/2013:08:16:07 -0400) - import userRoot: Generating numSubordinates complete.
[24/Jun/2013:08:16:07 -0400) - import userRoot: Flushing caches...
[24/Jun/2013:08:16:07 -0400) - import userRoot: Closing files...
[24/Jun/2013:08:16:07 -0400) - entrycache_clear_int: there are still 5 entries in the entry cache.
[24/Jun/2013:08:16:07 -0400) - dncache_clear-int: there are still 918 dn's in the dn cache. :/
[24/Jun/2013:08:16:07 -0400) - import userRoot: Import complete. Processed 918 entries in 4 seconds. (229.50 entries/sac)
[24/Jun/2013:08:16:07 -0400] NSMMReplicationPlugin - multimastar_be_state_change: replica dc:xxxxxx,dc=com is coming on
line: enabling replication
[24/Jun/2013:08:16:07 -0400] NSMMReplicationPlugin - replica_configure_ruv: failed to create replica ruv tombstone entry (dc=xxxxxx,dc-com): LDAP error - 68
I would like to add that all replicas that could not be configured due to the reported errors were installed on Solaris 10 on Sparc processors, whereas the only replica that was initialized successfully was installed on Solaris 10 on i386 processors.
Thanks,
Jovan
Jovan Vukotić * Senior Software Engineer * Ambit Treasury Management * SunGard * Banking * Bulevar Milutina Milankovića 136b, Belgrade, Serbia * tel: +381.11.6555-66-1 * jovan.vukotic(a)sungard.com<mailto:jovan.vukotic@sungard.com>
[Description: Description: Description: Description: Description: coc-signature-03-2012]<http://www.capitalize-on-change.com/?email=70150000000Y1Et>
Join the online conversation with SunGard's customers, partners and Industry experts and find an event near you at: www.sungard.com/ten<http://www.capitalize-on-change.com/?email=70150000000Y1Et>.
From: Vukotic, Jovan
Sent: Saturday, June 22, 2013 11:59 PM
To: '389-users(a)lists.fedoraproject.org'
Subject: fresh replica reports "reloading ruv failed " just after successfull initialization.
Hi,
We have four 389 DS, version 1.2.11 that we are organizing in multi-master replication topology.
After I enabled all four multi-master replicas and initialized them - from the one, referent replica M1 and Incremental Replication started, it turned out that only two of them are included in replication, the referent M1 and M2 (replication is working in both direction)
I tried to fix M3 and M4 in the following way:
M3 example:
removed replication agreement M1-M3 (M2-M3 did not existed, M4 switched off)
After several database restores of pre-replication state and reconfiguration of that replica, I removed 389 DS instance M3 completely and reinstalled it again: remove-ds-admin.pl + setup-ds-admin.pl. I configured TLS/SSL (as before), restarted the DS and enabled replica from 389 Console.
Then I returned to M1, recreated the agreement and did initialization of M3. It was successful again, in terms that M3 imported all the data, but immediately after that, to me strange errors were reported:
What confuses me is that LDAP 68 means that an entry already exits... even if it is a new replica. Why a tombstone?
Or to make the long story short: Is the only remedy to reinstall all four replica again?
22/Jun/2013:16:30:50 - 0400] - All database tnreaas now stopped // this is from a backup done before replication configuration
[22/Jun/2013:16:43:25 -0400] NSMMReplicationPlugin - multimaster_be_state_change: replica xxxxxxxxxx is going off line; disablin
g replication
[22/Jun/2013:16:43:25 -0400] - entrycache_clear_int: there are still 20 entries in the entry cache,
[22/Jun/2013:16:43:25 -0400] - dncache_clear_int: there are still 20 dns in the dn cache. :/
[22/Jun/2013:16:43:25 -0400] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access th
e database
[22/Jun/2013:16:43:30 -0400] - import userRoot: Workers finished; cleaning up..
[22/Jun/2013:16:43:30 -0400] - import userRoot: Workers cleaned up.
[22/Jun/2013:16:43:30 -0400] - import userRoot: Indexing complete. Post-processing...
[22/Jun/2013:16:43:30 -0400] - import userRoot: Generating numSubordinates complete.
[22/Jun/2013:16:43:30 -0400] - import userRoot: Flushing caches.
[22/Jun/2013:16:43:30 -0400] - import userRoot: Closing files.
[22/Jun/2013:16:43:30 -0400] - entrycache_clear_int: there are still 20 entries in the entry cache.
[22/Jun/2013:16:43:30 -0400] - dncache_clear_int: there are still 917 dn's in the dn cache. :/
[22/Jun/2013:16:43:30 -0400] - import userRoot: Import complete. Processed 917 entries in 4 seconds, (229.25 entries/sec)
[22/Jun/2013:16:43:30 -0400] NSMMRep1 icationPlugin - multimaster_be_state_change: replica xxxxxxxxxxx is coming online; enabling
replication
[22/Jun/2013:16:43:30 -0400] NSMMReplicationPlugin - replica_configure_ruv: failed to create replica ruy tombstone entry (xxxxxxxxxx); LDAP error - 68
[22/Jun/2013:16:43:30 -0400] NSMMReplicationPlugin - replica_enable_replication: reloading ruv failed
[22/Jun/2013:16:43:32 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68
[22/Jun/2013:16:44:02 -0400] NSMMReplicationPlugin - replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxxx); LDAP error - 68
[22/Jun/2013:16:44:32 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68
[22/Jun/2013:16:45:02 -0400] NSMMReplicationPluyin - _replica_confiyure_ruv: failed to create replica ruv tombstone entry (xxxxxxxx); LDAP error - 68
[22/Jun/2013:16:45:32 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68
[22/Jun/2013:16:46:02 -0400] NSMMReplicationPlugin - _replica_configure_ruv: failed to create replica ruv tombstone entry (xxxxxxxxx); LDAP error - 68
Any help will be appreciated.
Thank you.
Jovan Vukotić * Senior Software Engineer * Ambit Treasury Management * SunGard * Banking * Bulevar Milutina Milankovića 136b, Belgrade, Serbia * tel: +381.11.6555-66-1 * jovan.vukotic(a)sungard.com<mailto:jovan.vukotic@sungard.com>
[Description: Description: Description: Description: Description: coc-signature-03-2012]<http://www.capitalize-on-change.com/?email=70150000000Y1Et>
Join the online conversation with SunGard's customers, partners and Industry experts and find an event near you at: www.sungard.com/ten<http://www.capitalize-on-change.com/?email=70150000000Y1Et>.
10 years, 7 months
Install Fedora from its source code using virtual box
by Maryyam Muhammad Din
Hello,
Can anyone please guide me how can i compile Fedora from its source code by
using some kind of virtual machine. Actually i want to trace some signals;
especially termination signals SIGTERMSIGINT and SIGKILL. Currently i am
using fedora 19 and i want to install second operating system on virtual
machine (to edit and recompile its code)
Thank You
--
Maryyam Muhammad Din
Al-Khawarizmi Institute of Computer Science
UET Lahore
10 years, 7 months
passwordWarned and passwordExpirationTime
by Iain Morgan
Hello,
As I understand it, if a user authenticates to the LDAP server within
passwordWarning seconds of passwordExpirationTime and passwordExpWarned
is not set, the passwordExpirationTime attribute will automatically be
increased to ensure that the user has sufficient warning time. Is this
correct?
I would like to have passwordWarning set so that users have the
opportunity of being warned prior to password expiration, but due to
local policy I don't want passwordExpirationTime to be increased. Thus,
I'm willing to accept that in some cases users may a shorter warning
period, or not warning at all. Unfortunately, I don't see a way of doing
this.
Is there a way to disable the automatic adjustment of
passwordExpirationTime? I've tried using a CoS to set passwordExpWarned,
but that did not appear to work. I expect that I could write a plugin to
set passwordExpWarned right after the password has been changed, but
that seems like a reasonable bit of work. Any suggestions?
Thanks,
--
Iain Morgan
10 years, 7 months
problems with password policies
by Morgan Jones
Either I'm missing something or password policies just don't work in Redhat (CentOS) directory 8.2.8.
I started by creating a subtree policy on the command line:
# ./ns-newpwpolicy.pl -D cn=directory\ manager -w pass -h localhost -S ou=students,dc=domain,dc=org
adding new entry cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org
adding new entry cn=cn=nsPwPolicyEntry\,ou=students\,dc=domain\,dc=org,cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org
adding new entry cn=cn=nsPwTemplateEntry\,ou=students\,dc=domain\,dc=org,cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org
adding new entry cn=nsPwPolicy_cos,ou=students,dc=domain,dc=org
modifying entry cn=config
The following were created:
dn: cn=nsPwPolicyContainer,ou=students,dc=domain,dc=org
objectClass: top
objectClass: nsContainer
cn: nsPwPolicyContainer
dn: cn=cn=nsPwTemplateEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn=nsPwPolicyC
ontainer,ou=students,dc=domain,dc=org
objectClass: top
objectClass: extensibleObject
objectClass: costemplate
objectClass: ldapsubentry
cosPriority: 1
cn: cn=nsPwTemplateEntry,ou=students,dc=domain,dc=org
dn: cn=nsPwPolicy_cos,ou=students,dc=domain,dc=org
objectClass: top
objectClass: LDAPsubentry
objectClass: cosSuperDefinition
objectClass: cosPointerDefinition
costemplatedn: cn=cn=nsPwTemplateEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn=
nsPwPolicyContainer,ou=students,dc=domain,dc=org
cosAttribute: pwdpolicysubentry default operational-default
cn: nsPwPolicy_cos
dn: cn=cn=nsPwPolicyEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn=nsPwPolicyCon
tainer,ou=students,dc=domain,dc=org
objectClass: top
objectClass: ldapsubentry
objectClass: passwordpolicy
cn: cn=nsPwPolicyEntry,ou=students,dc=domain,dc=org
I added the policy attributes we're interested in:
dn: cn=cn=nsPwPolicyEntry\2Cou=students\2Cdc=domain\2Cdc=org,cn=nsPwPolicyCon
tainer,ou=students,dc=domain,dc=org
passwordResetFailureCount: 600
passwordMaxFailure: 10
passwordLockout: on
passwordMinLength: 6
objectClass: top
objectClass: ldapsubentry
objectClass: passwordpolicy
cn: cn=nsPwPolicyEntry,ou=students,dc=domain,dc=org
I then tried 11 ldapsearches as a user under ou=students,dc=domain,dc=org and the account was not locked out.
I then checked the console and the settings weren't there. I set them and it added two additional entries:
dn: cn=cn\3DnsPwPolicyEntry\2Cou\3Dstudents\2Cdc\3Ddomain\2Cdc\3Dorg,cn=nsPwP
olicyContainer,ou=students,dc=domain,dc=org
passwordMaxFailure: 10
passwordResetFailureCount: 600
passwordLockout: on
passwordStorageScheme: ssha
passwordCheckSyntax: on
passwordChange: off
passwordMinAge: 0
passwordExp: off
passwordMustChange: off
passwordMinLength: 6
objectClass: ldapsubentry
objectClass: passwordpolicy
objectClass: top
cn: cn=nsPwPolicyEntry,ou=students,dc=domain,dc=org
dn: cn=cn\3DnsPwTemplateEntry\2Cou\3Dstudents\2Cdc\3Ddomain\2Cdc\3Dorg,cn=nsP
wPolicyContainer,ou=students,dc=domain,dc=org
objectClass: extensibleObject
objectClass: costemplate
objectClass: ldapsubentry
objectClass: top
cosPriority: 1
cn: cn=nsPwTemplateEntry,ou=students,dc=domain,dc=org
However I still can't force a user to be locked out.
I did set passwordIsGlobalPolicy to on under cn=config though as far as I can tell that only affects replication of password policies.
Am I missing something?
thanks,
-morgan
10 years, 7 months
Problems setting up MMR
by Louis Bohm
I have 2 servers running cents 6.4 and the newest version of DS from the repos. Both serves have the same supplier DN. On the second server (ldap02) I go no errors when setting up the replication agreement. However, on the first server (ldap01) I got "LDAP error: No such object. Error code: 32". The logs on ldap02 show this:
[22/Aug/2013:15:14:17 -0400] conn=48 fd=71 slot=71 connection from 10.74.192.51 to 10.74.192.52
[22/Aug/2013:15:14:17 -0400] conn=48 op=0 BIND dn="cn=replication manager,cn=config" method=128 version=3
[22/Aug/2013:15:14:17 -0400] conn=48 op=0 RESULT err=32 tag=97 nentries=0 etime=0
[22/Aug/2013:15:14:17 -0400] conn=48 op=1 UNBIND
[22/Aug/2013:15:14:17 -0400] conn=48 op=1 fd=71 closed - U1
I guess the first thing I need to do is prove that supplier DN is really there and is the same. But I have been unable to come up with an ldapsearch that shows it. Or is the only way to see it is to grep the dse.ldif file?
Louis
10 years, 7 months
Best way to upgrade DS servers
by Chris Taylor
I am looking at replacing our two CentOS DS servers which are 5.9 with some on the 6.4 channel. What is the best way to transition all the data over? Should I build them separately and import everything via ldif files, or can I add them as consumers or in our setup as another master in our MMR setup.
To add a little complexity I have also added some RADIUS attributes to the schema so I am assuming that, those will need to be added before I setup any replication.
Any advice would be great.
Thanks,
Chris
10 years, 7 months
Replication Manager DN wrong
by Louis Bohm
Following the directions for setting up a supplier dn for replication I created a file with the following:
[root@ldap01 slapd-ldap01]# cat /root/supplier.ldif
dn: cn=replication manager,cn=config
objectClass: inetorgperson
objectClass: person
objectClass: top
cn: replication manager
sn: RM
userPassword: XXXXXXXXX
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0
And then I did cat /root/supplier.ldif >> /etc/dirsrv/slapd-ldap01/dse.ldif and then restarted dirsrv. When I do that I see the following.
Shutting down dirsrv:
ldap01... [ OK ]
Starting dirsrv:
ldap01...[22/Aug/2013:10:22:04 -0400] - Entry "cn=replication manager,cn=config" has unknown object class "inetorgperson " (remove the trailing space)
[22/Aug/2013:10:22:04 -0400] - Entry "cn=replication manager,cn=config" has unknown object class "person " (remove the trailing space)
[22/Aug/2013:10:22:04 -0400] - Entry "cn=replication manager,cn=config" has unknown object class "top " (remove the trailing space)
[ OK ]
How do I delete the entry or fix the entry? I tried to use ldapdelete to delete it but no luck.
ldapdelete -p 389 -h ldap01.us2.example.com -w XXXXX -D -D "cn=directory manager" "cn=replication manager,cn=config"
Thanks,
Louis
10 years, 7 months
Attribute value ordering
by Mitja Mihelič
Hi!
Out DIT holds user entries that have multiple "mail" attributes (main
email, aliases).
Here is an example entry:
dn: eduPersonPrincipalName=user(a)example.com,dc=example,dc=com
mail: nickname(a)example.com
mail: user(a)example.com
mail: user.name(a)example.com
Our application (e.g. WordPress) authenticates against the 389DS and
also pull some additional attributes, needed by the application. In this
case the email address.
The application picks up the first mail attribute received and uses it
as the user's email. In this case would be "nickname(a)example.com", which
is unwanted. The desired outcome would be the "user.name(a)example.com"
displayed as first.
By what algorithm/logic do the attributes get sorted? Time added perhaps?
Is there any way of influencing this sorting?
We were also thinking of putting the "main" email into another
attribute. Which attribute would be appropriate for something like this?
Regards,
Mitja
--
--
Mitja Mihelič
ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia
tel: +386 1 479 8877, fax: +386 1 479 88 78
10 years, 7 months
Random crashes under heavy load
by Mahadevan, Venkat
Hello,
I am running 389 DS 1.2.11.15-20 under RHEL 6.4.
When the server is subjected to heavy loads (many adds
and modifies, or many deletes), it will randomly crash.
A manual restart is then required which generates the
following message:
[21/Aug/2013:12:30:56 -0700] - Detected Disorderly Shutdown last time Directory Server was running, recovering database.
The server then takes a while to restart but eventually comes back up.
I was wondering if the cause of this was related to the following bug:
https://fedorahosted.org/389/ticket/47349
Would this assumption be accurate? Thanks.
cheers,
Ven
10 years, 7 months