X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=doc%2Fman%2Fman5%2Fslapd.conf.5;h=fd54e8929e5c3b0ae910be35e45535b1847d9e17;hb=9bef3574038a99a2c16ac54dab1ec352fc61c6fe;hp=9c30fe57804a6b1fba0d2c1ab1302a32767d16a9;hpb=35f44436790b7ffba60a3f323711458ad15e51bc;p=openldap diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 index 9c30fe5780..fd54e8929e 100644 --- a/doc/man/man5/slapd.conf.5 +++ b/doc/man/man5/slapd.conf.5 @@ -1,5 +1,5 @@ .TH SLAPD.CONF 5 "RELEASEDATE" "OpenLDAP LDVERSION" -.\" Copyright 1998-2014 The OpenLDAP Foundation All Rights Reserved. +.\" Copyright 1998-2017 The OpenLDAP Foundation All Rights Reserved. .\" Copying restrictions apply. See COPYRIGHT/LICENSE. .\" $OpenLDAP$ .SH NAME @@ -557,7 +557,7 @@ forms as well as numeric OIDs to be used for the syntax OID. description.) The slapd parser also honors the .B X\-SUBST -extension (an OpenLDAP-specific extension), which allows to use the +extension (an OpenLDAP-specific extension), which allows one to use the .B ldapsyntax statement to define a non-implemented syntax along with another syntax, the extension value @@ -566,7 +566,7 @@ as its temporary replacement. The .I substitute-syntax must be defined. -This allows to define attribute types that make use of non-implemented syntaxes +This allows one to define attribute types that make use of non-implemented syntaxes using the correct syntax OID. Unless .B X\-SUBST @@ -675,7 +675,7 @@ only messages that get logged whatever log level is set The desired log level can be input as a single integer that combines the (ORed) desired levels, both in decimal or in hexadecimal notation, as a list of integers (that are ORed internally), -or as a list of the names that are shown between brackets, such that +or as a list of the names that are shown between parentheses, such that .LP .nf loglevel 129 @@ -853,6 +853,17 @@ Specify which auxprop plugins to use for authentication lookups. The default is empty, which just uses slapd's internal support. Usually no other auxprop plugins are needed. .TP +.B sasl\-auxprops\-dontusecopy [...] +Specify which attribute(s) should be subject to the don't use copy control. This +is necessary for some SASL mechanisms such as OTP to work in a replicated +environment. The attribute "cmusaslsecretOTP" is the default value. +.TP +.B sasl\-auxprops\-dontusecopy\-ignore on | off +Used to disable replication of the attribute(s) defined by +sasl-auxprops-dontusecopy and instead use a local value for the attribute. This +allows the SASL mechanism to continue to work if the master is offline. This can +cause replication inconsistency. Defaults to off. +.TP .B sasl\-host Used to specify the fully qualified domain name used for SASL processing. .TP @@ -947,15 +958,16 @@ e.g. ldapi:// (and eventually IPSEC). It is not normally used. Specify an integer ID from 0 to 4095 for this server (limited to 3 hexadecimal digits). The ID may also be specified as a hexadecimal ID by prefixing the value with "0x". -These IDs are +Non-zero IDs are required when using multimaster replication and each master must have a -unique ID. Note that this requirement also applies to separate masters +unique non-zero ID. Note that this requirement also applies to separate masters contributing to a glued set of databases. If the URL is provided, this directive may be specified multiple times, providing a complete list of participating servers and their IDs. The fully qualified hostname of each server should be used in the supplied URLs. The IDs are used in the "replica id" field -of all CSNs generated by the specified server. The default value is zero. +of all CSNs generated by the specified server. The default value is zero, which +is only valid for single master replication. Example: .LP .nf @@ -1006,6 +1018,11 @@ Note that some OS-es implement automatic TCP buffer tuning. Specify the maximum size of the primary thread pool. The default is 16; the minimum value is 2. .TP +.B threadqueues +Specify the number of work queues to use for the primary thread pool. +The default is 1 and this is typically adequate for up to 8 CPU cores. +The value should not exceed the number of CPUs in the system. +.TP .B timelimit {|unlimited} .TP .B timelimit time[.{soft|hard}]= [...] @@ -1123,9 +1140,9 @@ token name first, followed by a colon: .nf TLSCertificateFile my hardware device:Server-Cert .fi -Use certutil -L to list the certificates by name: +Use certutil \-L to list the certificates by name: .nf - certutil -d /path/to/certdbdir -L + certutil \-d /path/to/certdbdir \-L .fi .TP .B TLSCertificateKeyFile @@ -1143,7 +1160,7 @@ protection for the cert/key database. For example, if TLSCACertificatePath specifes /etc/openldap/certdb as the location of the cert/key database, use modutil to change the password to the empty string: .nf - modutil -dbdir /etc/openldap/certdb -changepw 'NSS Certificate DB' + modutil \-dbdir /etc/openldap/certdb \-changepw 'NSS Certificate DB' .fi You must have the old password, if any. Ignore the WARNING about the running browser. Press 'Enter' for the new password. @@ -1555,8 +1572,8 @@ The keyword indicates that no limit is applied to the pagedResults control page size. The syntax .B size.prtotal={|unlimited|disabled} -allows to set a limit on the total number of entries that a pagedResults -control allows to return. +allows one to set a limit on the total number of entries that the pagedResults +control will return. By default it is set to the .B hard limit. @@ -1648,7 +1665,7 @@ is equivalent to (see above). The .B extended -keyword allows to indicate the OID of the specific operation +keyword allows one to indicate the OID of the specific operation to be restricted. .TP .B rootdn @@ -1774,13 +1791,14 @@ the contextCSN is stored in the context entry. .B [tls_cacert=] .B [tls_cacertdir=] .B [tls_reqcert=never|allow|try|demand] -.B [tls_ciphersuite=] +.B [tls_cipher_suite=] .B [tls_crlcheck=none|peer|all] .B [tls_protocol_min=[.]] .B [suffixmassage=] .B [logbase=] .B [logfilter=] .B [syncdata=default|accesslog|changelog] +.B [lazycommit] .RS Specify the current database as a replica which is kept up-to-date with the master content by establishing the current @@ -1864,7 +1882,11 @@ operation, a synchronization search remains persistent in the provider slapd. Further updates to the master replica will generate .B searchResultEntry to the consumer slapd as the search responses to the persistent -synchronization search. +synchronization search. If the initial search fails due to an error, the +next synchronization search operation is periodically rescheduled at an +interval time (specified by +.B interval +parameter; 1 day by default) If an error occurs during replication, the consumer will attempt to reconnect according to the @@ -1992,6 +2014,12 @@ to the obsolete \fIchangelog\fP format. If the .B syncdata parameter is omitted or set to "default" then the log parameters are ignored. + +The +.B lazycommit +parameter tells the underlying database that it can store changes without +performing a full flush after each change. This may improve performance +for the consumer, while sacrificing safety or durability. .RE .TP .B updatedn