Resonant Information - Rant - Comments

LDAP backups

Zed — Mon, 20 Feb 2006 14:30:22 -0500

Make sure your backup scripts generate staggered backups over the last week or two. It's quite possible to generate two days in a row worth of corrupt backups without realizing it.

Also, I've only ever had problems on SMP machines. You may want to make your main auth server single-processor and see if that helps.

It's scary how close our situations are...

Anonymous — Mon, 20 Feb 2006 11:27:13 -0500

I also have a script to backup my ldap daily.

I even modified the postfix config NOT to start up if LDAP is in it's successfully-started-but-hung state.

Here is my restore script:

/etc/init.d/slapd stop
killall -9 slapd
rm -rf /var/lib/openldap-data
mkdir /var/lib/openldap-data
chown ldap:ldap /var/lib/openldap-data
/etc/init.d/slapd start
ldapadd -x -D cn=admin,dc=blah,dc=co,dc=za -W < backup.ldif

I've done this many times, and all forums do is blame filesystem/os/db instability... but no clue on how to resolve it.

-cry-

I think LDAP is the only really good and neat solution, but if I cannot get some stabiulity (the ldap db coruupts practically after every system crash and some plain reboots)

Marius van Wyk

It's a pity...

Zed — Thu, 27 Jan 2005 13:00:27 -0500

... that everything else is worse. Even with the problems, I'm very happy to be finally through with NIS, and I'm not ready to move to a complete Kerberos infrastructure. That didn't keep me from being royally pissed at the time, of course.

To be fair, with the current version (2.1.30) my only problem seems to be with very sporadic performance breakdowns (it grinds nearly to a halt every other month or so), and on SMP systems only (my uniprocessor servers are fine). Those can be fixed simply be restarting slapd periodically. Changing backends didn't help — I experienced exactly the same problem with LDBM as with BDB. I suspect a very obscure race condition somewhere.

I'm running about 1200 entries on the SMP system, and only 200 on the uniprocessor system, though, which may have something to do with it.

By the way, I have seen ActiveDirectory collapse as well, and it's far harder to clean up, so going to Microsoft won't help you there, plus it gets you all of the baggage of a Microsoft server. If you want commercial support, you might want to give Netscape Directory Server a try, or go with one of the places that provides support for OpenLDAP. (I'm not endorsing any of the places in those links, but just noting them as a possibility.)

OpenLDAP Really Really SUCKS

Anonymous — Thu, 27 Jan 2005 05:50:31 -0500

I agree, and have experienced all the same issues like this ...
If OpenLDAP team blames BerkleyDB, why the hell they dont use some other backend databse as default.

My problem is simple but very critical; My ldap data got usually corrupt saying that it has some indexing issue, I tried to turn off all indexing it worked fine, but the LDAP_SEARCH was dam slow. In my case indexing is vital.

I dont know why OpenLDAP even exists, its good only as a toy for very small entries. (i am talking about less then 100).

If there exists a solution, I would more then glad to know. Else I will be shifting to the Great Microsoft World ! Where everything atleast is usable.

I am really really pissed off with OpenLDAP data corruption.
Posted on several mailing lists and http://www.ldapguru.com, but no one has ever replied ... !!!

If you know any solution, instead to turn indexes off that will be more then a bottel of wine for me.