[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: LDAP database timeout settings



On Windows 2008R2, here are the steps. This needs done on each DC I believe.Â

As administrator in CMD on a DC:

ntdsutil
ldap policies
connections
connect to server DCNAME
q
set MaxConnIdleTime to TIMEVALUE (we used 3600 seconds)
commit changes
q
q

Hope that helps!

-Kyle

On Tue, Dec 11, 2012 at 9:10 AM, Matthew M. DeLoera <mdeloera@exacq.com> wrote:
AD has an inactivity/idle default timeout of 900 seconds. I suspect you can google to find the setting name, and where it's stored, in your AD server(s).

Hope that helps.

- Matthew


On Dec 10, 2012, at 8:35 PM, Bryce Powell wrote:

Having done some more research, it appears that Active Directory also has some settings that could result in disconnected connections. I experimented with idle-timeout set to 30 seconds for the LDAP databases, but this seemed to exacerbate the frequency of the errors. The behaviour exhibits as âdeadâ connections, and LDAP does not appear to attempt to re-establish these connections. Using the CentOS distro of OpenLDAPÂ2.4.23
Â
Here are the slapd.conf settings:
Â
databaseÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ ldap
readonlyÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ on
suffixÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ "dc=xyz,dc=local"
#noundeffilterÂÂÂÂÂÂÂÂÂÂ yes
#use-temporary-connÂÂÂÂÂ yes
uriÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ "ldap://IP1/Âldap://IP2/Âldap://3/Âldap://IPn/"
Â
Â
databaseÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ ldap
readonlyÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ on
suffixÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ "dc=abc,dc=adroot,dc=abc,dc=bc,dc=ca"
#noundeffilterÂÂÂÂÂÂÂÂÂÂ yes
#use-temporary-connÂÂÂÂÂ yes
uriÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ "ldap://IP11/Âldap://IP12/Âldap://13/Âldap://IP1n/"
Â
Â
I have some rewrite rules for bindDN, searchEntryDN, searchAttrDN, matchedDN, but I donât believe these settings are relevant to the issue at hand.
Â
Essentially I want the connections to be re-established without generating errors.
Â
Thanks
____________________________________________