Hello Florence.
Can you see in 389-ds logs which operation is triggering the size-limit
error? In /var/log/dirsrv/slapd-domXXX/access, you will find a line with
RESULT err=4, note the conn=xx and op=yy values, then look above for a
line with conn=xx op=yy SRCH and finally another line above with conn=xx
op=0 BIND. Please paste the 3 lines for analysis.
How do you identify the lines concerned please ?
Is "conn" a unique ID of the connection ?
I find this concerning the connection 33725735 that I think I am using :
674:[20/Dec/2018:10:30:34 +0100] conn=33725735 fd=64 slot=64 connection from <MyIPAServerIP> to <MyIPAServerIP>
715:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI
716:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=0 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress
717:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI
718:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=1 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress
719:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI
720:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=<MyUser>,cn=users,cn=accounts,dc=<MyRealm>"
721:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=3 MOD dn="cn=<MyBigGroup>,cn=groups,cn=accounts,dc=<MyRealm>"
725:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=3 RESULT err=0 tag=103 nentries=0 etime=0
735:[20/Dec/2018:10:30:34 +0100] conn=33725735 op=4 SRCH base="cn=ipaconfig,cn=etc,dc=<MyRealm>" scope=0 filter="(objectClass=*)" attrs=ALL
753:[20/Dec/2018:10:31:07 +0100] conn=33725735 op=4 RESULT err=3 tag=101 nentries=0 etime=33
841:[20/Dec/2018:10:31:08 +0100] conn=33725735 op=5 UNBIND
842:[20/Dec/2018:10:31:08 +0100] conn=33725735 op=5 fd=64 closed - U1
I cannot find anything related to conn=33725735 between line #735 and line #753.
So I find that there are 3 errors, but I don't have details of these errors.
The size limits are configured at multiple levels:
- at IPA level: with ipa config-show, you can see the settings that IPA
is using for all the queries triggered by ipa *-find commands.
- at 389-ds level: the attribute nsslapd-sizelimit of the entry
cn=config is also limiting the number of returned entries
- at 389-ds level: the attributes nsSizeLimit and nsLookThroughLimit of
the entry cn=anonymous-limits,cn=etc,$BASEDN limit the number of
returned entries for anonymous queries
- it is also possible to configure per-user limits, for instance in
uid=user,cn=users,cn=accounts,$BASEDN with the attributes nsSizeLimit
nsLookThroughLimit nsPagedLookThroughLimit and nsPagedSizeLimit