389-users August 2010

389-users@lists.fedoraproject.org

33 participants
57 discussions

Automatic master/consumer initialization
by Gerrard Geldenhuis 24 Aug '10

24 Aug '10

Hi Is there any difference between right clicking on a replication agreement just created and selecting the Initialize Consumer or letting "nature" go its course and letting replication happen in the next "cycle". Up until now I have created replication agreements using the GUI, but I have now started doing it via ldif files. If I don't immediately run: dn: cn=%repl-agreement-name%,cn=replica,cn=dc\3dCompany,cn=mapping tree,cn=config changetype: modify replace: nsds5beginreplicarefresh nsds5beginreplicarefresh: start It seems to start on its own anyway. Having checked the data nothing looks wrong so I thought I would just double check. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 2

AUTO : Serge Sterck est absent(e) (renvoi de Mer 01/09/2010)
by Serge.Sterck＠fmsb.be 24 Aug '10

24 Aug '10

Je suis absent(e) entre Lun 23/08/2010 et Mer 01/09/2010. Remarque : ceci est une réponse automatique à votre message "Re: [389-users] Automatic master/consumer initialization" envoyé le 24.8.10 3:31:17. C'est la seule notification que vous recevrez pendant l'absence de cette personne.

1 0

Inconsistency between GUI and ldapquery regarding replication agreements
by Gerrard Geldenhuis 24 Aug '10

24 Aug '10

Hi We ran into a very interesting problem... We can't run 389-console directly from the server on which it is running because it is just to slow to use. It takes almost 5 minutes just to login. We have thus resorted to running the console locally and doing port forwarding with ssh as 389 and 636 is blocked. This worked great until now. We created aliases to localhost for the server names eg: 127.0.0.1 authserver1.example.com authserver1 ssh -f -N -L 9830:authserver1:9830 authserver-ip ssh -f -N -L 389:authserver1:389 authserver-ip ssh -f -N -L 636:authserver1:636 authserver-ip This works for individual servers but we now have a shared netscaperoot. What happens is that when we open up the console and connect to the any directory server we are actually connecting to localhost and thus end up seeing the same information for each server (not completely) it confuses the GUI no end. This email's purpose is two fold, one is for the record and hopefully someone else will read this and not make the same mistake. Two, realizing that I have asked this before any suggestions for speeding up the console. It just seems odd that there is such a fast difference between running the console locally and running it remotely via ssh. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Variables in ldif files
by Gerrard Geldenhuis 21 Aug '10

21 Aug '10

Hi Is there any standard script that comes with 389 that can take a set of parameters and replace those parameters in a ldif file? For example the parameters specified in /usr/share/dirsrv/data/template-suffix-db.ldif dn: cn=%ds_bename%,cn=ldbm database,cn=plugins,cn=config I can write my own but if there is something I can just adopt that would be very useful. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

Script to ingest audit file to database
by Juan Asensio Sánchez 21 Aug '10

21 Aug '10

Hi Has anyone developed a script to do that? I need this, but I want to be sure there is no a script that already exists. If not, I will do it. So, is there any library for Perl to analyze that file, i.e., give the list of entries, modifications made to that entries (add, modify, delete, modrdn), etc? Also, could the Directory Server redirect the output of the audit to the input of that script instead of the file? regards.

2 1

csngen_adjust_time: adjustment limit exceeded
by Juan Asensio Sánchez 20 Aug '10

20 Aug '10

Hi I am having problems with some replicas. Using 389 DS 1.2.5, CentOS 5.5. A few days ago, a server crashed, and when restarted, it had the time of the crash (more than 1 day). Just after the server started up, the time was sync with the NTP, but when dirsrv started, the time was wrong. Since that, the replication agreements of the multimaster database it hosts, is giving problems: "-1 Incremental update has failed and requires administrator actionSystem error". So, I am trying to initialize the rest of the servers from the "main" (tha server where the most os the modifications are done, we have 6 servers in multimaster mode for the database, and other databases in hub mode). When I try to initialize the server, i get this error on the supplier: "Replication error acquiring replica: excessive clock skew. Error Code: 2", although all the servers have the same time. In the consumer log, I get this: [16/Aug/2010:10:04:58 +0200] - csngen_adjust_time: adjustment limit exceeded; value - 1390893, limit - 86400 [16/Aug/2010:10:04:58 +0200] - CSN generator's state: [16/Aug/2010:10:04:58 +0200] - replica id: 5 [16/Aug/2010:10:04:58 +0200] - sampled time: 1281945898 [16/Aug/2010:10:04:58 +0200] - local offset: 0 [16/Aug/2010:10:04:58 +0200] - remote offset: 0 [16/Aug/2010:10:04:58 +0200] - sequence number: 111 I am stuck now. Tried to export database from supplier, import it in the consumer, and try to reinitialize without success. Also tried to disable the replica on both supplier and consumer, reenable it, and recreate the replication agreements without success. I have seen this bug https://bugzilla.redhat.com/show_bug.cgi?id=233642, but we have version 1.2.5, so his bug is supposed to be fixed. This is the result of the readNsState.py on the supplier (only for the database giving problems): nsState is BAAAADT2aEwAAAAAAQAAAAQAAAA= Little Endian For replica cn=replica, cn="dc=XXXXX,dc=XXXX", cn=mapping tree, cn=config fmtstr=[H2x3IH2x] size=20 len of nsstate is 20 CSN generator state: Replica ID : 4 Sampled Time : 1281947188 Gen as csn : 4c68f634000400040000 Time as str : Mon Aug 16 10:26:28 2010 Local Offset : 0 Remote Offset : 1 Seq. num : 4 System time : Mon Aug 16 10:26:42 2010 Diff in sec. : 14 Day:sec diff : 0:14 And this in the consumer: nsState is BQAAAPv1aEwAAAAAAAAAAAIAAAA= Little Endian For replica cn=replica, cn="dc=XXX,dc=XXXXX", cn=mapping tree, cn=config fmtstr=[H2x3IH2x] size=20 len of nsstate is 20 CSN generator state: Replica ID : 5 Sampled Time : 1281947131 Gen as csn : 4c68f5fb000200050000 Time as str : Mon Aug 16 10:25:31 2010 Local Offset : 0 Remote Offset : 0 Seq. num : 2 System time : Mon Aug 16 10:26:24 2010 Diff in sec. : 53 Day:sec diff : 0:53 I think the low remote offset (accoriding to the bug this number should increase with the changes) is due to the initialization of the database from the exports. Any help? All replication agreements are a disaster now :S. Regards and thanks in advance.

2 5

Help setting up a subsuffix
by Javier Aravena Claramunt 19 Aug '10

19 Aug '10

Hello, I'm trying to figure out how to create a subsuffix in its own database so I can syncronize a part of the directory in master-slave fashion, but I can't figure out how to. I create the subsuffix in the console by using the context menu in the root suffix in the Data part of the configuration tab, but I can't see the new ou. I've tried creating the ou before the subsuffix, but that doesn't seem to work either. I read something about the new subsuffix not having ACIs, but as I can't see the ou, I can't seem to configure the ACIs of the subsuffix. Any pointers on what to do between creating a new subsufix and using it would be really apreciated :) Regards, -- Javier Aravena Claramunt http://javier.aravenas.com javier(a)aravenas.com

1 0

Clarification on admin server and console
by Jonathan Boulle 18 Aug '10

18 Aug '10

I've been trawling through the documentation trying to get a better understanding of "best practices" for use of the console and admin server in an environment with a large number of directory servers. In the perfect scenario, we would like to be able to manage the entire estate (multiple locations) using one instance of the console; or perhaps one console per location. Unfortunately I'm not finding it straightforward. I understand that on a (physical/virtual) server there can be multiple directory server instances but only one admin server instance. However, what I'm wondering is whether it is possible for an instance of the admin server to manage directory servers on different boxes. For example, could I have one admin server per location - where a location houses X physical servers each running a DS instance (a mix of read-only consumers and read-write suppliers)? This brings obvious benefits as regards easier backup and a single point of administration, but also becomes a bit of a single point of failure. If not, is it necessary/standard to run an admin server per physical server, and then group them in the console by having them all share a single configuration server (as specified in setup-ds-admin.pl)? Although again this creates a single POF, at least with administration - or have I got the wrong end of the stick entirely? One more point: the Console and Admin Server documentation has diagrams which reference "external programs"; what kind of things does this refer to? Is there a typical use case? Thanks Jonathan ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

3 16

NetscapeRoot longevity
by Gerrard Geldenhuis 18 Aug '10

18 Aug '10

Hi The database name NetscapeRoot I assume is a leftover from when 389 was a netscape product. Is there any plans to eventually change this to 389-root or something similar. It would be a purely cosmetic change though and probably way to much work and introduce many bugs... but I thought I would ask. Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 1

System configuration data
by Natr Brazell 17 Aug '10

17 Aug '10

All, I've been using 389 server for basic authentication only. I here folks use it for storing system information such as hostnames, IPs, MAC addresses etc and then generate dns file or DHCP files etc. I'm curious if there are any resoures that will tell me how to set up such an environment or if this forum can provide me with some howto's, example ldif files etc and perhaps some practical applications? Thanks, N

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2010