389-users February 2026

389-users@lists.fedoraproject.org

6 participants
5 discussions

389ds 2.5 deployment issue
by tdarby＠arizona.edu 28 Feb '26

28 Feb '26

This past weekend I finally replaced the last of our DS 1.3 instances (1.3.6.12 to be exact). We did a lot of testing but what happened in production with a full prod workload was quite surprising. This 1.3 instance has been in operation for over a decade and has never had any issues with memory usage (it has 16GB total). When we moved the 2.5 instance into production, the amount of memory usage quickly rose to over 16GB, causing AWS ECS to kill the task. I tried upping the instance type to r6i.xlarge (32GB) and that quickly ran out of memory too. r6i.2xlarge also failed with excessive memory consumption. It wasn't until I switched to r6i.4xlarge (128GB) that the instances finally more or less stabilized at approx. 60GB of memory use. Other info: - This is using bdb, not mdb. - We tried to keep the cn=config values as close as possible to the original instance. - Over a year ago, we did the same thing with a different production system (moved it to 2.5 bdb) and it's typically consuming about 32GB in spite of being a significantly larger database. - We used the same docker image from docker hub for both of these systems (2.5.0 B2024.017.0000). For the system we moved this past weekend, here are some daily stats: SRCH Events BIND Events MOD Events SRCH/BIND 2026-01-01T00:00:00.000-0700 71422 18013 1136 397% 2026-01-02T00:00:00.000-0700 88233 26273 1958 336% 2026-01-03T00:00:00.000-0700 71724 20275 1512 354% 2026-01-04T00:00:00.000-0700 90487 26763 2271 338% 2026-01-05T00:00:00.000-0700 232190 69743 5602 333% 2026-01-06T00:00:00.000-0700 270592 65322 5752 414% 2026-01-07T00:00:00.000-0700 288077 73869 6021 390% 2026-01-08T00:00:00.000-0700 276662 69352 6309 399% 2026-01-09T00:00:00.000-0700 265886 62109 4992 428% 2026-01-10T00:00:00.000-0700 201912 33331 2528 606% 2026-01-11T00:00:00.000-0700 229512 44090 2956 521% 2026-01-12T00:00:00.000-0700 333711 97047 6494 344% 2026-01-13T00:00:00.000-0700 384455 121332 7049 317% 2026-01-14T00:00:00.000-0700 544805 202567 10667 269% 2026-01-15T00:00:00.000-0700 523023 180011 38875 291% 2026-01-16T00:00:00.000-0700 393932 121466 27357 324% 2026-01-17T00:00:00.000-0700 235071 47104 10557 499% 2026-01-18T00:00:00.000-0700 269432 64199 9329 420% 2026-01-19T00:00:00.000-0700 299010 76743 9937 390% 2026-01-20T00:00:00.000-0700 501148 176427 16488 284% 2026-01-21T00:00:00.000-0700 466164 164206 13574 284% 2026-01-22T00:00:00.000-0700 422490 141143 9041 299% 2026-01-23T00:00:00.000-0700 360027 109641 8832 328% 2026-01-24T00:00:00.000-0700 230624 48358 5385 477% 2026-01-25T00:00:00.000-0700 292855 75711 7428 387% 2026-01-26T00:00:00.000-0700 449129 151908 11426 296% 2026-01-27T00:00:00.000-0700 433417 146937 9902 295% 2026-01-28T00:00:00.000-0700 425190 142981 9832 297% 2026-01-29T00:00:00.000-0700 401043 132635 8418 302% 2026-01-30T00:00:00.000-0700 350886 102997 6616 341% 2026-01-31T00:00:00.000-0700 235397 49611 4578 474% The system we moved earlier has 10 times as much search traffic as this one, but this one gets up to 4 times as many binds. Any thoughts on what might be going on here? Tim

2 5

memberof entries not displayed in uid ( version 3.1)
by Ghiurea, Isabella 07 Feb '26

07 Feb '26

Hi List, I 'm testing DS migration from 389-DS 1.2.3 to 389-DS 3.1 RH9 with memberof plugin been enable when checking for users the entries for memberof are missing. for each uid. Are any cfg params in dse.ldif which may stop from displaying the memberof entries ? See details : # 8211065Users, ds, xxxx dn: uid=8211065,ou=Users,ou=ds,dc=xxxxx userPassword:: e1NTSEF9K25kcXZ = Missing memberOf entries In old 389-DS version 1.2.3 I have for same uid dn: uid=8211065ou=Users,ou=ds,dc=xxxx ****memberOf: cn=xxxx,ou=Groups,ou=ds,dc=xxxxxxx >>> mssing for each uid in 389-DS version 3.1 ****memberOf: cn=xxxx-users,ou=Groups,ou=ds,dc=cxxxx >>>same ####################################### DS version 3.1 errorlog dsconf slapd-testldap plugin memberof fixup "dc=xxx,dc=xxx" dsconf slapd-testldap plugin memberof fixup-status INFO - memberof-plugin - memberof_fixup_task_thread - Memberof task starts (filter: "(|(objectclass=inetuser)(objectclass=inetadmin)(objectclass=nsmemberof))") ... [05/Feb/2026:18:44:51.265924012 -0800] - INFO - memberof-plugin - memberof_fixup_task_thread - Memberof task finished (processed 45844 entries in 5 seconds) ###################################################### dsconf slapd-testldap plugin memberof show dn: cn=MemberOf Plugin,cn=plugins,cn=config cn: MemberOf Plugin memberofattr: memberOf memberofgroupattr: member nsslapd-plugin-depends-on-type: database nsslapd-pluginDescription: memberof plugin nsslapd-pluginEnabled: on nsslapd-pluginId: memberof nsslapd-pluginInitfunc: memberof_postop_init nsslapd-pluginPath: libmemberof-plugin nsslapd-pluginType: betxnpostoperation nsslapd-pluginVendor: 389 Project nsslapd-pluginVersion: 3.1.3 objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject Thank you Isabella

3 3

3.1 version where i are ndexes ?
by Ghiurea, Isabella 07 Feb '26

07 Feb '26

HI List I 'm testing a new 389-DS version 3.1 i RH 9 installation, I followed the RH Doc for migration from version 1.2.3 copy only content and user.ldif , I re-create my indexes with dsconf but I can not find where are this new LMDB indexes files? ( Iin old 1.2.3 I used the default userroot , but I can not find such userroot db in latest veersion ?) Do I need to create userroot directory before or after indexes creation ? sslapd-db-home-directory: /var/lib/dirsrv/slapd-test/db /var/lib/dirsrv/slapd-testl/db/ w-r--r--. 1 dirsrv dirsrv 75 Feb 5 09:27 INFO.mdb -rw-------. 1 dirsrv dirsrv 15899 Feb 5 09:27 data.mdb -rw-------. 1 dirsrv dirsrv 8192 Feb 5 11:16 lock.mdb Thank you Isabella

4 4

Migration to RHEL 9 389-DS from CentOS 7
by Paul Whitney 06 Feb '26

06 Feb '26

Good morning, We are finally migrating from 389-ds-base 1.3.7.5 to 2.7.0-7. My scenario: I have deployed several suppliers in a multi-replication configuration, the same as I did with the CentOS 7 deployment. I have one replication agreement from a CentOS 7 supplier to a RHEL 9 supplier. The RHEL 9 supplier then replicates to all of the other suppliers. A couple of questions: 1. Should the CSN count be identical between the CentOS 7 and RHEL 9? Regarding initializing the hosts, when I initialize a supplier, a lot of log.0 type files get created in the /var/lib/dirsrv/slapd-name/db directory. If I don't monitor the partition there is a risk of filling up to 100%. 1. What are these files? Does it hurt to remove them? 2. And when importing, after a pass restarts, would it not make sense that those files get cleaned up in the initializing process to avoid filling up the partition? Thanks, Paul M. Whitney, CISSP Chesapeake IT Consulting, Inc. 890 Hudson Road Cambridge, MD 21613 Work: 443-492-2872 Cell: 410.493.9448 Email: paul.whitney(a)chesapeake-it.com<mailto:paul.whitney@chesapeake-it.com> CONFIDENTIALITY NOTICE The information contained in this facsimile or electronic message is confidential information intended for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this facsimile message to the intended recipient, you are hereby notified that any dissemination, or copying of this communication is strictly prohibited. If this message contains non-public personal information about any consumer or customer of the sender or intended recipient, you are further prohibited under penalty of law from using or disclosing the information to any third party by provisions of the federal Gramm-Leach-Bliley Act. If you have received this facsimile or electronic message in error, please immediately notify us by telephone and return or destroy the original message to assure that it is not read, copied, or distributed by others.

2 1

missing nssalpd-cachec-autosizing in 3.1.3
by Ghiurea, Isabella 05 Feb '26

05 Feb '26

HI 389-DS List. I am testing the following DS installation 389-ds-base-libs-3.1.3 , the RH Docs mentioned for tuning the DS there is a an important parameter: nsslapd-cache-autosize in 3.1 version , but I am not seeing this entry in dse.ldif . I cfg the DS instance for ' mdb' database in template file >> this should be the mem db not the Berkley db .({ there are still entries in dse.ldif related to Berkely db I understood this db is obsolete now )} Which one of the following parameters is related to cache_autosize? This is from dse.ldif nsslapd-cachesize: -1 nsslapd-cachememsize: 512000 nsslapd-readonly: off nsslapd-require-index: off nsslapd-require-internalop-index: off nsslapd-dncachememsize: 16777216 numSubordinates: 4 And more default cfg nsslapd-lookthroughlimit: 5000 nsslapd-mode: 600 nsslapd-idlistscanlimit: 2147483646 nsslapd-directory: /var/lib/dirsrv/slapd-testldap/db nsslapd-import-cachesize: 16777216 nsslapd-idl-switch: new nsslapd-search-bypass-filter-test: on nsslapd-search-use-vlv-index: on nsslapd-exclude-from-export: entrydn entryid dncomp parentid numSubordinates tombstonenumsubordinates entryusn nsslapd-serial-lock: on nsslapd-pagedlookthroughlimit: 0 nsslapd-pagedidlistscanlimit: 0 nsslapd-rangelookthroughlimit: 5000 nsslapd-backend-opt-level: 1 nsslapd-backend-implement: mdb nsslapd-db-durable-transaction: nsslapd-mdb-max-size: 7408818586 nsslapd-mdb-max-readers: 0 nsslapd-mdb-max-dbs: 512 Thank you for your feedback!

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2026