Re: Shell script to monitor LDAP server

[Oliver Liebel <oliver@itc.li>]

regarding to your description,

> bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 
> <http://192.168.1.102:7323> 'objectclass=top' namingContexts
> ldapsearch: started Fri Jun 13 02:11:04 2008
>
> ldap_init( 192.168.1.102:7323 <http://192.168.1.102:7323>, 389 )
> filter pattern: objectclass=top
> returning: namingContexts
> filter is: (objectclass=top)
>
> And it just stays here forever. The -l flag only works after the 
> search is initiated server side. There isn't a switch for a connection 
> timeout limit.  With this behaviour I can't test this as I imagined.

you cant search anything
with ldapsearch  if the remote server is down
or traffic is temporariliy blocked by packet-filter
because ldapsearch hangs til next ice-age.

in this case it doesnt matter at all what kind of searchfilter is used.

the problem ist the reachabilty of the remote machine
as far as you cant specify any timeout
on your solaris ldapsearch-tool.

if you want to stay on trying a scripting solution, maybe this is worse 
an attempt:
nmap  <host> | grep 389 <or whatever port you use>
oder
netstat <host> -pan | grep \:389 | grep LISTEN
if [ $? -eq  0] 
then
   ldapsearch bla...
else [ do nothing ]
fi

on the other side you can use monit to watch the remote slapd,
but if the remote monit traffic is blocked by packet-filter too
you got the same situation - remote machine is not reachable <for you>



Dieter Kluenter schrieb:
> "Dieter Kluenter" <dieter@dkluenter.de> writes:
>
>   
> > "Alexandre Vieira" <nullpt@gmail.com> writes:
> >
> >     
> > > Hello all,
> > >
> > > I have a Solaris 10 system that queries a clients openldap server to deliver a
> > > certain service and the client is complaining that my system sometimes denies
> > > services to clients. Well my system only denies service to clients if the
> > > openldap system from the customer fails to answer.
> > >
> > > In this sense I tried to write a script to monitor the openldap server and its
> > > responsiveness but ldapsearch client in Solaris 10 doesn't work as I expected
> > > :(
> > >
> > > For example, all ok:
> > >
> > > bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top'
> > > namingContexts
> > > ldapsearch: started Fri Jun 13 01:51:53 2008
> > >       
> > You should search the monitor backend, with something like
> > ldapsearch -b "cn=connections,cn=monitor" -s sub 
> >     
>
> Let me elaborate on this a bit further:
>
> ldapsearch -b "cn=connections,cn=monitor" -s sub monitorcounter gives
> information on following items
>
> monitorConnectionNumber:
> monitorConnectionOpsReceived:
> monitorConnectionOpsExecuting: 
> monitorConnectionOpsPending: 
> monitorConnectionOpsCompleted:
> monitorConnectionGet:
> monitorConnectionRead:
> monitorConnectionWrite:
>
> in addtion to connections you may search cn=waiters,cn=monitor, which
> gives information on waiters of all operations.
>
>
> -Dieter
>
>   

____________
Virus checked by G DATA AntiVirusKit
Version: AVK 18.4116 from 13.06.2008
Virus news: www.antiviruslab.com