[Date Prev][Date Next] [Chronological] [Thread] [Top]

RE: ldapsearch on accesslog hangs in OpenLDAP 2.4.40 on RHEL 6.9 ( works ok w/ slapcat -b "cn=accesslog")

HI Quanah .

Thanks for the enlightenment. I was starting to think I had missed something and kept re-installing and re-configuring and getting same issues.

Also to add more fuel to the fire it seemed that whenever I accessed the suffixvia an  ldapsearch and then did an "ls"  on the /var/lib/ldap/accesslog directory the db files never changed in size. As well slapcat would not see any new accesslog entries ( nor would ldapsearch ) unless I restarted slapd services. Then I would see new entries from the previous ldapsearch of the suffix with slapcat but the db files would still be the same size. The read date/time stamp would only change when the slapd service was restarted.

At any rate I will download the new 2.4.45 as you suggested and move away from the OpenLDAP 2.4.40 fron rhel .

Regards

Ron L.

-----Original Message-----
From: Quanah Gibson-Mount [mailto:quanah@symas.com] 
Sent: June-23-17 5:19 PM
To: Ron Lamarche <Ron.Lamarche@innovapost.com>; openldap-technical@openldap.org
Subject: Re: ldapsearch on accesslog hangs in OpenLDAP 2.4.40 on RHEL 6.9 ( works ok w/ slapcat -b "cn=accesslog")

--On Thursday, June 22, 2017 9:19 PM +0000 Ron Lamarche <Ron.Lamarche@innovapost.com> wrote:

> I've installed the RHEL 6.9 OpenLDAP bundled product and have a 
> working suffix based on cn=config vs. slapd.conf  model but cannot get 
> the accesslog overlays/DB's to work  properly (ldapsearch returns 
> accesslog records but never completes and instead hangs showing 
> "ldap_int_select" . Need to ctl –c to exit )

Hi Ron,

The OpenLDAP build distributed by RedHat is known to have severe issues. 
It is strongly recommended to avoid their OpenLDAP builds because of this and their advanced age.  If you are not able to build OpenLDAP yourself, the LTB project provides standard OpenLDAP builds for free: 
<http://ltb-project.org/wiki/download#openldap>

If you require support, Symas (my employer) has such an offering.  Our OpenLDAP builds also include features not yet available from the OpenLDAP project.

You may be well facing any of a number of bugs that have been fixed in the
2.5 years since 2.4.40 was released, in particular:

        Fixed slapd cn=config when updating olcAttributeTypes (ITS#8199)
        Fixed slapo-accesslog to honor pauses during purge for cn=config update (ITS#8423)

Finally, I would also note that the back-bdb backend has been deprecated since OpenLDAP 2.3, and as of OpenLDAP 2.4, back-hdb is also deprecated. 
The recommended backend is back-mdb, which is built on top of LMDB (<http://www.symas.com/lmdb/>,
<https://en.wikipedia.org/wiki/Lightning_Memory-Mapped_Database>)

In general, issues with RedHat's build will not be explored unless you can reproduce the same problem with a current build of OpenLDAP.

Regards,
Quanah

--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>