Chapter 17. Setting up Content Synchronization Using the SyncRepl Protocol

1. To verify if the retro changelog is already enabled, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin retro-changelog show
   ...
   nsslapd-pluginEnabled: off

   If the nsslapd-pluginEnabled parameter is set to off, the retro changelog is disabled. To enable, see Section 15.21.1, “Enabling the Retro Changelog Plug-in”.
2. Add the nsuniqueid attribute to retro changelog plug-in configuration:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin retro-changelog set --attribute nsuniqueid:targetUniqueId

3. Optionally, apply the following recommendations for improved performance:
   1. Set maximum validity for entries in the retro change log. For example, to set 2 days (2d):

      # ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x
      
      dn: cn=changelog5,cn=config
      changetype: modify
      replace: nsslapd-changelogmaxage
      nsslapd-changelogmaxage: 2d

   2. If you know which back end or subtree clients access to synchronize data, limit the scope of the Retro Changelog plug-in. For example, to exclude the cn=demo,dc=example,dc=com subtree, enter:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin retro-changelog set --exclude-suffix "cn=demo,dc=example,dc=com"

# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin set --enabled on "Content Synchronization"

aci: (targetattr != "aci")(version 3.0; acl "Sync Request Control";
   allow( read, search ) userdn = "ldap:///all";)

# dsctl instance_name restart