I'm experiencing synchronization problem with my ldap provider-consumer setup.
Both nodes are running OpenLDAP 2.4.38 (using mdb backend) at x86_64
under Linux 3.7.10.
Both servers synchronize their time with one NTP server, so clocks are in sync.
I have cn=dhcp,dc=my,dc=org containter which I would like to replicate to openldap
consumer.
Consumer uses old-fasioned slapd.conf file:
# [... include, acl and logging settings skipped ...]
rootdnÂÂÂ ÂÂÂ "cn=root,dc=my,dc=org"
rootpwÂÂÂÂÂÂÂ [ skipped ]
indexÂÂÂ objectClassÂÂÂ eq
indexÂÂÂ entryCSNÂÂÂ eq
indexÂÂÂ entryUUIDÂÂÂ eq
indexÂÂÂ dlzHostnameÂÂÂ eq
indexÂÂÂ dlzZoneNameÂÂÂ eq
indexÂÂÂ dlzIPAddrÂÂÂ eq
indexÂÂÂ dlzTypeÂÂÂ ÂÂÂ eq
indexÂÂÂ dhcpHWAddressÂÂÂ eq
indexÂÂÂ cnÂÂÂ ÂÂÂ eq,approx,sub
syncreplÂÂÂ rid=1
...
syncreplÂÂÂ rid=2
ÂÂÂ provider=ldap://
172.20.20.207ÂÂÂ type=refreshAndPersist
ÂÂÂ interval=00:00:01:00
ÂÂÂ retry="60 +"
ÂÂÂ searchbase="cn=dhcp,dc=my,dc=org"
ÂÂÂ filter="(objectClass=*)"
ÂÂÂ scope=sub
ÂÂÂ schemachecking=off
ÂÂÂ bindmethod=simple
ÂÂÂ binddn="uid=dhcpd,ou=services,dc=my,dc=org"
ÂÂÂ credentials="[ skipped ]"
Problem is that not all changes (adding new objects and changing attributes of existing
objects) are replicated from master to consumer. I make change on master by hand, but
I do not see log entries on consumer that changed attribute was replicated.
LDAP provider setup (uses online configuartion):
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=my,dc=org
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcLimits: {0}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" size=unlimited
olcLimits: {1}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" time=unlimited
olcLimits: {2}group/groupOfNames/member="cn=admins,ou=mail,ou=groups,dc=my,dc=org" size=unlimited
olcLimits: {3}group/groupOfNames/member="cn=replicators,ou=groups,dc=my,dc=org" size=unlimited time=unlimited
User uid=dhcpd,ou=services,dc=my,dc=org is member of group cn=replicators,ou=groups,dc=my,dc=org.
dn: cn=Replicators,ou=Groups,dc=my,dc=org
cn: Replicators
member: uid=dhcpd,ou=services,dc=my,dc=org
Indices on master server:
olcDbIndex: dhcpHWAddress,dhcpClassData eq
ACL for cn=dhcp,dc=my,dc=org container (I have only one ACL entry, that mentions cn=dhcp,dc=my,dc=org):
...
olcAccess: {15}to dn.subtree="cn=dhcp,dc=my,dc=org"
 by group/groupOfNames/member.exact="cn=dhcp readers,ou=dhcp,ou=groups,dc=my,dc=org" read
 by group/groupOfNames/member.exact="cn=dhcp writers,ou=dhcp,ou=groups,dc=my,dc=org" write
...
dn: cn=dhcp readers,ou=dhcp,ou=Groups,dc=my,dc=org
cn: dhcp readers
objectClass: groupOfNames
objectClass: top
member: uid=dhcpd,ou=Services,dc=my,dc=org
So for now I checked following:
1. Clocks on both server (both are in sync)
2. ACL for replication DN (replication user is able to read all needed data).
3. Size and time limits for replication DN (replication user has no limits on operations).
4. Schema (objectClasses and attrubutes) on both servers (both nodes use same schemas).
5. Disable indices on consumer server for replicated attributes from cn=dhcp,dc=my,dc=org container (not helped)
What else I can check?
BTW, I would be pleased if someone give somekind of systematic approach for troubleshooting OpenLDAP replication issues.