Upgrade from OpenLDAP 2.1.30 -> 2.3.37

[Leon de Rooij <leon@scarlet-internet.nl>]

Hi all,

After a period of testing I upgraded our LDAP servers from 2.1.30 to
2.3.37. Many things were done, changed replication from slurpd to
syncrepl, changed backend from ldbm to hdb, even changed the structure
of the tree a bit, almost everything works great :)

Except some searches are slower !

I have around 160K dn's with around 3.2M attrs in a server with 4G
memory with a tree looking like this (simplified):

o=sp
|
ou=users
|
namespace=domain.com
|
uid=username

Now, when I do this search:

# time ldapsearch -b "o=sp" "mail=user@domain.com" dn

dn: uid=user,namespace=domain.com,ou=users,o=sp

real    0m0.005s
user    0m0.000s
sys     0m0.000s

But when I do this search:

# time ldapsearch -b "ou=users,o=sp" "mail=user@domain.com" dn

dn: uid=user,namespace=domain.com,ou=users,o=sp

real    0m0.190s
user    0m0.000s
sys     0m0.000s

(even after a couple of searches, the numbers stay the same)

That's 50 times slower ! Right now all machines using LDAP are doing
fine, but I'd like the searches with a different base than o=sp to be
the same speed (I expected them to be even quicker because there's less
to search, or am I wrong ?)

(BTW, on our old LDAP, searches within o=sp were equally quick as
searches in a different basedn, around 0.009 s real)

I have indexed o, ou and namespace with pres and eq (and mail with pres,
eq and sub), so I don't see a problem there. I still have to look a bit
more into DB_CONFIG tuning, but still, is it normal behaviour of
OpenLDAP 2.3.37 with hdb backend that searches in a subtree are slower
than in the base of the tree ?

Just before sending this mail I also tried searching like this:

# time ldapsearch -b "namespace=domain.com,ou=users,o=sp"
"mail=user@domain.com" dn

dn: uid=user,namespace=domain.com,ou=users,o=sp

real    0m0.015s
user    0m0.000s
sys     0m0.000s

So that's in between both previous searches.. strange..

thanks & regards,

Leon de Rooij
leon@scarlet-internet.nl