Re: Database indexing: slapindex

[Ralf Haferkamp <rhafer@suse.de>]

On Mittwoch 13 Juli 2011 09:49:06 openldap@ayni.com wrote:
> Hi listers
> 
> Installation here:
> openldap-servers-2.4.15-7.fc11.i586
> 
> One master server, two backup servers (syncrepl).
> 
> All authentication and mailing is managed by ldap.
> 
> 1. About indexing:
> 
> When i check the slapd-log, i see many
> 
> <= bdb_equality_candidates: (uidNumber) not indexed
> 
> <= bdb_equality_candidates: (gidNumber) not indexed
> 
> In the discussion about slapd tuning
> http://www.openldap.org/doc/admin24/tuning.html#Indexes, however, i
> read that if each entry in a certain set of ldap-entries has got the
> candidate-attribute, it is not worth while to index the attribute,
> because slapd needs to read each entry in any case in order to find
> the requested one. this is the case for uidNumber as well as
> gidNumber, because both are compulsory attributes for objectClass
> posixAccount.
>
> My first question:
> is it therefore correct to disregard the above indexing requests of
> slapd?
No. The Admin Guide section you are referring to is about "presence" 
indexing. The log message you pasted above is about a missing "equality" 
index.

> 2. About slapindex:
> 
> When it comes to use slapindex, the docu is not clear about how to do
> that. Some places say, that you need to stop slapd entirely, some
> places say that it is sufficient to put slapd in read-only mode for
> the corresponding background database, which in this case would be
> /etc/openldap/slapd.d/cn=config/olcDatabase\=\{2\}bdb.ldif
> this file contains both the olcReadOnly and the olcDbIndex attributes.
> 
> So i could just add the following two lines in the above file:
> olcDbIndex: uidNumber eq
> olcDbIndex: gidNumber eq
> set the olcReadOnly attribute to TRUE, and restart slapd, and
> everything would be done automatically?
No. If you are using cn=config you should only do configuration via LDAP.
You should never touch the files in /etc/openldap/slapd.d/ directly 
(there have been many threads about why touching /etc/openldap/slapd.d/ 
is a bad idea, please see the archives for details).

If you add the new index by doing an ldapmodify on 
"olcDatabase={2}bdb,cn=config" you get the additional benefit that slapd 
will start generating the new indexes on the fly in the background. No 
need to run slapindex in that case.

> Or would i need to invoke slapindex additionally with the following
> command slapindex -c
> 
> And if i had to start slapindex additionally, would slapindex tell me,
> that the database is in read-only mode, so no changes are possible,
> not even index changes?
> 
> And, if i had to start slapindex additionally, i would do it as root.
> the files generated by slapindex would they be owned by root
> (inaccessible by slapd) or by the slapd user?
> 
> Would the new indexes be propagated to the backup servers by syncrepl
> automatically? If not, what would i have to change on the backup
> servers?
Depends on the configuration of your servers. Do they replicate the 
cn=config database as well?  If yes they'll automatically get the 
configuration changes (if you did them via LDAP).

Ralf