Configuring and managing replication

Procedure

1. Enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 1

   Copy to Clipboard Toggle word wrap

   This command configures the supplier.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this entry to 1.

   Important

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. Add the replication agreement and initialize the consumer:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt create --suffix "dc=example,dc=com" --host "consumer.example.com" --port 389 --conn-protocol=LDAP --bind-dn "cn=replication manager,cn=config" --bind-passwd "password" --bind-method=SIMPLE --init example-agreement

   Copy to Clipboard Toggle word wrap

   This command creates a replication agreement named example-agreement. The replication agreement defines settings, such as the consumer’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to this consumer.

   After the agreement was created, Directory Server initializes consumer.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Display the replication configuration:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication get --suffix "dc=example,dc=com"
   dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
   ...
   nsDS5ReplicaRoot: dc=example,dc=com
   nsDS5ReplicaType: 3
   ...

   Copy to Clipboard Toggle word wrap

   These parameters indicate:

   • nsDS5ReplicaRoot sets the suffix that is replicated.
   • nsDS5ReplicaType set to 3 defines that this host is a supplier.

2. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement
   Agreement successfully initialized.

   Copy to Clipboard Toggle word wrap

3. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement
   Status For Agreement: "example-agreement" (consumer.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210330075608Z
   Last Update End: 20210330075608Z
   Number Of Changes Sent: 1:3/0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210330074603Z
   Last Init End: 20210330074606Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (6062d73c000000010000) consumer (Unavailable) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Copy to Clipboard Toggle word wrap

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com config replace nsslapd-idletimeout=7200

   Copy to Clipboard Toggle word wrap

   To set an unlimited period, set nsslapd-idletimeout to 0.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. Click Enable Replication.

4. Select Consumer in the Replication Role field, and enter the replication manager account and the password to create:

   

   View larger image

   

   These settings configure the host as a consumer for the dc=example,dc=com suffix. Additionally, the server creates the cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

5. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Consumer, replication is enabled, and the host is configured as a consumer.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, replication manager credentials, and leave the Bind Group DN field empty:

      

      View larger image

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 1.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

   3. Click Enable Replication.

4. Add a replication agreement and initialize the consumer:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      View larger image

      

      These settings create a replication agreement named example-agreement. The replication agreement defines settings, such as the consumer’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to this consumer.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the consumer after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes consumer.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

   View larger image

   

Procedure

1. Enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 2 --bind-dn "cn=replication manager,cn=config" --bind-passwd "password"

   Copy to Clipboard Toggle word wrap

   This command configures the supplier1.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this entry to 2. Additionally, the command creates the cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

   Important

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. Add the replication agreement and initialize the new server:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com repl-agmt create --suffix "dc=example,dc=com" --host "supplier2.example.com" --port 389 --conn-protocol LDAP --bind-dn "cn=replication manager,cn=config" --bind-passwd "password" --bind-method SIMPLE --init example-agreement-supplier1-to-supplier2

   Copy to Clipboard Toggle word wrap

   This command creates a replication agreement named example-agreement-supplier1-to-supplier2. The replication agreement defines settings, such as the new supplier’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the new supplier.

   After the agreement was created, Directory Server initializes supplier2.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Display the replication configuration:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com replication get --suffix "dc=example,dc=com"
   dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
   ...
   nsDS5ReplicaBindDN: cn=replication manager,cn=config
   nsDS5ReplicaRoot: dc=example,dc=com
   nsDS5ReplicaType: 3
   ...

   Copy to Clipboard Toggle word wrap

   These parameters indicate:

   • nsDS5ReplicaBindDN specifies the replication manager account.
   • nsDS5ReplicaRoot sets the suffix that is replicated.
   • nsDS5ReplicaType set to 3 defines that this host is a supplier.

2. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-supplier1-to-supplier2
   Agreement successfully initialized.

   Copy to Clipboard Toggle word wrap

3. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-supplier1-to-supplier2
   Status For Agreement: "example-agreement-supplier1-to-supplier2" (supplier2.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331071545Z
   Last Update End: 20210331071546Z
   Number Of Changes Sent: 2:1/0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331071541Z
   Last Init End: 20210331071544Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (6064219e000100020000) consumer (Unavailable) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)

   Copy to Clipboard Toggle word wrap

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com config replace nsslapd-idletimeout=7200

   Copy to Clipboard Toggle word wrap

   To set an unlimited period, set nsslapd-idletimeout to 0.

Verification

1. Display the agreement status:

   # dsconf -D "cn=Directory Manager" ldap://supplier2.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-supplier2-to-supplier1
   Agreement successfully initialized.

   Copy to Clipboard Toggle word wrap

2. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier2.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-supplier2-to-supplier1
   Status For Agreement: ""example-agreement-supplier2-to-supplier1 (supplier1.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331073540Z
   Last Update End: 20210331073540Z
   Number Of Changes Sent: 7:1/0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331073535Z
   Last Init End: 20210331073539Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (60642649000000070000) consumer (Unavailable) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Copy to Clipboard Toggle word wrap

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier2.example.com config replace nsslapd-idletimeout=7200

   Copy to Clipboard Toggle word wrap

   To set an unlimited period, set nsslapd-idletimeout to 0.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, as well as the distinguished name (DN) and password of the replication manager account to create:

      

      View larger image

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 1.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

      If you set no replication manager DN, set a bind group DN. You can then use any member of this group in the replication agreement.

   3. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Supplier, replication is enabled, and the host is configured as a supplier.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, as well as the distinguished name (DN) and password of the replication manager account to create:

      

      View larger image

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 2.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

   3. Click Enable Replication.

4. Add a replication agreement and initialize the new server:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      View larger image

      

      These settings create a replication agreement named example-agreement-supplier1-to-supplier2. The replication agreement defines settings, such as the new supplier’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the new supplier.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the new server after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes supplier2.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

   View larger image

   

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Add a replication agreement and initialize the existing server:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      View larger image

      

      These settings create a replication agreement named example-agreement-supplier2-to-supplier1. The replication agreement defines settings, such as the existing server’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the existing supplier.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the new server after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes supplier1.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

   View larger image

   

Procedure

1. Create the ou=services entry if it does not exist:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: ou=services,dc=example,dc=com
   objectClass: organizationalunit
   objectClass: top
   ou: services

   Copy to Clipboard Toggle word wrap

2. Create accounts for both servers, such as cn=server1,ou=services,dc=example,dc=com and cn=server1,ou=services,dc=example,dc=com:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: cn=server1,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server1
   cn: server1
   userPassword: password
   userCertificate:< file:///root/server1.der
   
   adding new entry "cn=server1,ou=services,dc=example,dc=com"
   
   dn: cn=server2,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server2
   cn: server2
   userPassword: password
   userCertificate:< file:///root/server2.der
   
   adding new entry "cn=server2,ou=services,dc=example,dc=com"

   Copy to Clipboard Toggle word wrap

3. Create a group, such as cn=repl_servers,dc=groups,dc=example,dc=com:

   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group create --cn "repl_servers"

   Copy to Clipboard Toggle word wrap

4. Add the two replication accounts as members to the group:

   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group add_member repl_servers "cn=server1,ou=services,dc=example,dc=com"
   
   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group add_member repl_servers "cn=server2,ou=services,dc=example,dc=com"

   Copy to Clipboard Toggle word wrap

Procedure

1. On server2.example.com, enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 2 --bind-dn "cn=replication manager,cn=config" --bind-passwd "password"

   Copy to Clipboard Toggle word wrap

   This command configures the server2.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this host to 2. Additionally, the command creates a temporary cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. On server1.example.com:

   1. Enable replication:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication enable --suffix="dc=example,dc=com" --role="supplier" --replica-id="1"

      Copy to Clipboard Toggle word wrap

   2. Create a temporary replication agreement which uses the temporary account from the previous step for authentication:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-dn="cn=Replication Manager,cn=config" --bind-passwd="password" --bind-method=SIMPLE --init temporary_agreement

      Copy to Clipboard Toggle word wrap

Verification

1. Verify that the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt init-status --suffix "dc=example,dc=com" temporary_agreement
   Agreement successfully initialized.

   Copy to Clipboard Toggle word wrap

Procedure

1. On server1.example.com:

   1. Remove the temporary replication agreement:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt delete --suffix="dc=example,dc=com" temporary_agreement

      Copy to Clipboard Toggle word wrap

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

      Copy to Clipboard Toggle word wrap

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

      Copy to Clipboard Toggle word wrap

2. On server2.example.com:

   1. Remove the temporary replication manager account:

      # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication delete-manager --suffix="dc=example,dc=com" --name="Replication Manager"

      Copy to Clipboard Toggle word wrap

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

      Copy to Clipboard Toggle word wrap

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf -D "cn=Directory Manager" ldap://server2.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

      Copy to Clipboard Toggle word wrap

   4. Create the replication agreement with certificate-based authentication:

      dsconf -D "cn=Directory Manager" ldaps://server2.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server2-to-server1

      Copy to Clipboard Toggle word wrap

3. On server1.example.com, create the replication agreement with certificate-based authentication:

   dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server2.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server1-to-server2

   Copy to Clipboard Toggle word wrap

Verification

1. Verify on each server that the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt init-status --suffix "dc=example,dc=com" server1-to-server2
   Agreement successfully initialized.
   
   # dsconf -D "cn=Directory Manager" ldaps://server2.example.com repl-agmt init-status --suffix "dc=example,dc=com" server2-to-server1
   Agreement successfully initialized.

   Copy to Clipboard Toggle word wrap

Procedure

1. Enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 1

   Copy to Clipboard Toggle word wrap

   This command configures the supplier.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this entry to 1.

   Important

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. Add the replication agreement and initialize the new server:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt create --suffix "dc=example,dc=com" --host "hub.example.com" --port 389 --conn-protocol LDAP --bind-dn "cn=replication manager,cn=config" --bind-passwd "password" --bind-method SIMPLE --init example-agreement-supplier-to-hub

   Copy to Clipboard Toggle word wrap

   This command creates a replication agreement named example-agreement-supplier-to-hub. The replication agreement defines settings, such as the hub’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the hub.

   After the agreement was created, Directory Server initializes hub.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Display the replication configuration:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication get --suffix "dc=example,dc=com"
   dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
   ...
   nsDS5ReplicaRoot: dc=example,dc=com
   nsDS5ReplicaType: 3
   ...

   Copy to Clipboard Toggle word wrap

   These parameters indicate:

   • nsDS5ReplicaRoot sets the suffix that is replicated.
   • nsDS5ReplicaType set to 3 defines that this host is a supplier.

2. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-supplier-to-hub
   Agreement successfully initialized.

   Copy to Clipboard Toggle word wrap

3. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-supplier-to-hub
   Status For Agreement: "example-agreement-supplier-to-hub" (hub.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331105030Z
   Last Update End: 20210331105030Z
   Number Of Changes Sent: 0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331105026Z
   Last Init End: 20210331105029Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (Unknown) consumer (Unknown) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Copy to Clipboard Toggle word wrap

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com config replace nsslapd-idletimeout=7200

   Copy to Clipboard Toggle word wrap

   To set an unlimited period, set nsslapd-idletimeout to 0.

Verification

1. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://hub.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-hub-to-consumer
   Agreement successfully initialized.

   Copy to Clipboard Toggle word wrap

2. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://hub.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-hub-to-consumer
   Status For Agreement: "example-agreement-hub-to-consumer" (consumer.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331131534Z
   Last Update End: 20210331131534Z
   Number Of Changes Sent: 0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331131530Z
   Last Init End: 20210331131533Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (Unknown) consumer (Unknown) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Copy to Clipboard Toggle word wrap

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://hub .example.com config replace nsslapd-idletimeout=7200

   Copy to Clipboard Toggle word wrap

   To set an unlimited period, set nsslapd-idletimeout to 0.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Consumer in the Replication Role field, and enter the replication manager account and the password to create:

      

      View larger image

      

      These settings configure the host as a hub for the dc=example,dc=com suffix.

   3. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Hub, replication is enabled, and the host is configured as a consumer.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, as well as the distinguished name (DN) and password of the replication manager account to create:

      

      View larger image

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 1.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

   3. Click Enable Replication.

4. Add a replication agreement and initialize the new server:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      View larger image

      

      These settings create a replication agreement named example-agreement-supplier-to-hub. The replication agreement defines settings, such as the hub’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to this hub.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the new server after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes hub.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

   View larger image

   

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. Click Enable Replication.

4. Select Consumer in the Replication Role field, and enter the replication manager account and the password to create:

   

   View larger image

   

   These settings configure the host as a consumer for the dc=example,dc=com suffix. Additionally, the server creates the cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

5. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Consumer, replication is enabled, and the host is configured as a consumer.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Add a replication agreement and initialize the consumer:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      View larger image

      

      These settings create a replication agreement named example-agreement-hub-to-consumer. The replication agreement defines settings, such as the consumer’s host name, protocol, and authentication information that the hub uses when connecting and replicating data to this consumer.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the consumer after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes consumer.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

   View larger image

   

Procedure

1. Set the timeout value for the suffix:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication set --suffix="dc=example,dc=com" --repl-release-timeout=70

   Copy to Clipboard Toggle word wrap

   This command changes the replication timeout of the example,dc=com suffix to 70 seconds.

2. Restart the instance:

   # dsctl instance_name restart

   Copy to Clipboard Toggle word wrap

Procedure

1. On the Replication tab, select the suffix entry.
2. Click Show Advanced Settings.
3. Update the value in the Replication Release Timeout field.
4. Click Save Configuration.

Procedure

1. To initialize a consumer, run:

   # dsconf <supplier_instance_name> repl-agmt init --suffix="dc=example,dc=com" <supplier_consumer_agreement_name>

   Copy to Clipboard Toggle word wrap

   Depending on the amount of data to replicate, the initialization can be time-consuming.

Procedure

1. Open the Replication menu, and select the suffix you plan to replicate.
2. On the Agreements tab, click the Options menu (⋮) next to the name of the replication agreement, and select Initialize Agreement.

3. Confirm the initialization by checking Yes, I am sure checkbox in the pop-up window.

   Depending on the amount of data to replicate, the initialization can be time-consuming.

Procedure

1. On a supplier server, perform the following steps:

   1. Shut down the instance on the supplier:

      # dsctl <supplier_instance_name> stop

      Copy to Clipboard Toggle word wrap

   2. Export the userRoot database that contains the suffix to replicate into the /var/lib/dirsrv/slapd-<supplier_instance_name>/ldif/example.ldif file with replication information:

      # dsctl <supplier_instance_name> db2ldif userRoot /var/lib/dirsrv/slapd-<supplier_instance_name>/ldif/example.ldif

      Copy to Clipboard Toggle word wrap

   3. Start the instance on the supplier:

      # dsctl <supplier_instance_name> start

      Copy to Clipboard Toggle word wrap

2. On a consumer server, perform the following steps:

   1. Shut down the instance on the consumer:

      # dsctl <consumer_instance_name> stop

      Copy to Clipboard Toggle word wrap
   2. Copy the exported example.ldif file to the /var/lib/dirsrv/slapd-<consumer_instance_name>/ldif/ directory on the consumer.
   3. Import the userRoot database from the /var/lib/dirsrv/slapd-<consumer_instance_name>/ldif/example.ldif file. For more information how to import data by using the dsctl ldif2db command, see Importing data using the command line while the server is offline.

   4. Start the instance on the consumer:

      # dsctl <consumer_instance_name> start

      Copy to Clipboard Toggle word wrap

Procedure

1. On the consumer or hub to remove:

   1. List the suffixes and their corresponding databases:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix list
      dc=example,dc=com (userroot)

      Copy to Clipboard Toggle word wrap

      Note the name of the databases.

   2. Set the databases into read-only mode to prevent any further updates:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix set --enable-readonly "userroot"

      Copy to Clipboard Toggle word wrap

2. On all suppliers that have a replication agreement with the consumer or hub you want to remove:

   1. List the replication agreements for the suffix that is replicated:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      Copy to Clipboard Toggle word wrap

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

      Copy to Clipboard Toggle word wrap

3. On the consumer or hub to remove, disable replication for all suffixes:

   # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com replication disable --suffix "dc=example,dc=com"

   Copy to Clipboard Toggle word wrap

   If this host was a hub, disabling replication automatically also deletes all replication agreements for this suffix on this server.

Procedure

1. On the supplier to remove:

   1. List the suffixes and their corresponding databases:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix list
      dc=example,dc=com (userroot)

      Copy to Clipboard Toggle word wrap

      Note the name of the databases.

   2. Set the databases into read-only mode to prevent any further updates:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix set --enable-readonly "userroot"

      Copy to Clipboard Toggle word wrap

   3. Wait until all other servers in the topology received all data from this supplier. To verify, ensure that the CSN on other servers is equal or greater than the CSN on the supplier to remove:

      # ds-replcheck online -D "cn=Directory Manager" -w password -m ldap://host-to-remove.example.com:389 -r ldap://server.example.com:389 -b dc=example,dc=com
      ================================================================================
               Replication Synchronization Report  (Tue Mar  5 09:46:20 2021)
      ================================================================================
      
      Database RUV's
      =====================================================
      
      Supplier RUV:
        {replica 1 ldap://host-to-remove.example.com:389} 5c7e8927000100010000 5c7e89a0000100010000
        {replicageneration} 5c7e8927000000010000
      
      Replica RUV:
        {replica 1 ldap://host-to-remove.example.com:389} 5c7e8927000100010000 5c7e8927000400010000
        {replica 2 ldap://server.example.com:389}
        {replicageneration} 5c7e8927000000010000

      Copy to Clipboard Toggle word wrap

   4. Display the replica ID:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com replication get --suffix "dc=example,dc=com" | grep -i "nsds5replicaid"
      nsDS5ReplicaId: 1

      Copy to Clipboard Toggle word wrap

      In this example, the replica ID is 1. Remember your replica ID for the last step of this procedure.

2. On all suppliers that have a replication agreement with the host you want to remove:

   1. List the replication agreements for the suffix that is replicated:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      Copy to Clipboard Toggle word wrap

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

      Copy to Clipboard Toggle word wrap

3. On the supplier to remove, disable replication for all suffixes:

   # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com replication disable --suffix "dc=example,dc=com"

   Copy to Clipboard Toggle word wrap

   Disabling replication automatically also deletes all replication agreements for this suffix on this server.

4. Before you proceed, ensure that all Directory Server instances listed in the Replica RUV section of the ds-replcheck output are online.

5. On one of the remaining suppliers in the topology, clean the RUVs for the replica ID:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-tasks cleanallruv --suffix "dc=example,dc=com" --replica-id 1

   Copy to Clipboard Toggle word wrap

   This command requires that you specify the replica ID displayed in an earlier step of this procedure.

Procedure

1. Enable replication logging:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-errorlog-level=8192

   Copy to Clipboard Toggle word wrap

   Note that this command enables only replication logging, and logging other error messages is disabled.

2. Monitor the /var/log/dirsrv/slapd-instance_name/errors log file and search for the following error message:

   Replica Busy! Status: [Error (1) Replication error acquiring replica: replica busy]

   Copy to Clipboard Toggle word wrap

   Note that it is normal if Directory Server occasionally logs this error. However, if replicas frequently do not receive updates, and the suppliers log this error, consider updating your configuration to solve this problem.

Procedure

1. Set the nsds5ReplicaBusyWaitTime parameter to configure the time a supplier waits before starting another attempt to acquire access to a replica after the replica sent a busy response:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt set --suffix "dc=example,dc=com" --busy-wait-time 5 replication_agreement_name

   Copy to Clipboard Toggle word wrap

   This command sets the time to wait to 5 seconds. This setting applies only to the specified replication agreement.

2. Set the nsds5ReplicaSessionPauseTime parameter to configure the time a supplier waits between two update sessions:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt set --suffix "dc=example,dc=com" --session-pause-time 15 replication_agreement_name

   Copy to Clipboard Toggle word wrap

   This command sets the pause to 15 seconds. By default, nsds5ReplicaSessionPauseTime is one second longer than the value in nsds5ReplicaBusyWaitTime. This setting applies only to the specified replication agreement.

3. Set the nsds5ReplicaReleaseTimeout parameter to terminate replication sessions after a given amount of time regardless of whether or not sending the update is complete:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication set --suffix "dc=example,dc=com" --repl-release-timeout 90

   Copy to Clipboard Toggle word wrap

   This command sets the timeout to 90 seconds. This setting applies to all replication agreements for the specified suffix.

4. Optional: Set a timeout period for a supplier so that it does not stay connected to a consumer infinitely attempting to send updates over a slow or broken connection:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt set --conn-timeout 600 --suffix "dc=example,dc=com" replication_agreement_name

   Copy to Clipboard Toggle word wrap

   This command sets the timeout to 600 seconds (10 minutes). To identify the optimum value, check the access log for the average amount of time the replication process takes, and set the timeout period accordingly.

Procedure

1. Check if the replication agreement has an update schedule configured:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt get --suffix "dc=example,dc=com" example-agreement

   Copy to Clipboard Toggle word wrap

   If the output of the command contains nsDS5ReplicaUpdateSchedule: * or the nsDS5ReplicaUpdateSchedule parameter is not present, no update schedule is configured.

   If nsDS5ReplicaUpdateSchedule contains a schedule, such as shown in the following, note the value:

   nsDS5ReplicaUpdateSchedule: 0800-2200 0246

   Copy to Clipboard Toggle word wrap

2. If an update schedule is configured, enter the following command to temporary disable it:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt set --schedule \ --suffix "dc=example,dc=com" example-agreement*

   Copy to Clipboard Toggle word wrap

3. Temporarily disable the replication agreement:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt disable --suffix "dc=example,dc=com" example-agreement

   Copy to Clipboard Toggle word wrap

4. Re-enable the replication agreement to force the replication update:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt enable --suffix "dc=example,dc=com" example-agreement

   Copy to Clipboard Toggle word wrap

5. If a replication schedule was configured at the beginning of this procedure, set the schedule to the previous value:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt set --schedule "0800-2200 0246" --suffix "dc=example,dc=com" example-agreement

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. Open the Agreements tab.

4. Check if the replication agreement has an update schedule configured:

   1. Click the overflow menu next to the agreement, and select Edit Agreement.

   2. On the Scheduling tab, note the values that are currently set.

      

      View larger image

      

      If Use A Custom Schedule is not selected, no schedule is configured.

5. Click the overflow menu next to the replication agreement, and select Disable/Enable Agreement to disable the agreement.

   The status of the agreement in the State column is now Disabled.

6. Click the overflow menu next to the replication agreement again, and select Disable/Enable Agreement to re-enable the replication agreement and enforce the replication update.

   The status of the agreement in the State column is now Enabled.

7. If a replication schedule was configured at the beginning of this procedure, set the schedule to the previous values:

   1. Click click the overflow menu, and select Actions → Edit Agreement.
   2. On the Scheduling tab, set the previous values.

Procedure

1. If the replica to promote is a hub with replication agreements, and the hub should no longer send data to other hosts after the promotion, remove the replication agreements:

   1. List the replication agreements on the hub:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      Copy to Clipboard Toggle word wrap

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement from the hub:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

      Copy to Clipboard Toggle word wrap

2. Promote the instance:

   • If you promote a consumer or hub to a supplier, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication promote --suffix "dc=example,dc=com" --newrole "supplier" --replica-id 2

     Copy to Clipboard Toggle word wrap
     Important

     The replica ID must be a unique integer value between 1 and 65534 for a suffix across all suppliers in the topology.

   • If you promote a consumer to a hub, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication promote --suffix "dc=example,dc=com" --newrole "hub"

     Copy to Clipboard Toggle word wrap
3. If the replica in its new role should send updates to other hosts in the topology, create replication agreements.

Procedure

1. If the replica to promote is a hub with replication agreements, and the hub should no longer send data to other hosts after the promotion, remove the replication agreements:

   1. Navigate to Replication → Agreements.
   2. Click Actions next to the agreement you want to delete, and select Delete Agreement.

2. Navigate to Replication → Configuration, and click the Change Role button.

   • If you promote a consumer or hub to a supplier, select Supplier, and enter a unique replica ID.

     Important

     The replica ID must be a unique integer value between 1 and 65534 for a suffix across all suppliers in the topology.

   • If you promote a consumer to a hub, select Hub.
3. Select Yes, I am sure.
4. Click Change Role.
5. If the replica in its new role should send updates to other hosts in the topology, create replication agreements.

Procedure

1. If the replica to demote has replication agreements that are no longer needed, for example, because you demote the replica to a consumer, remove the replication agreements:

   1. List the replication agreements on the replica:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      Copy to Clipboard Toggle word wrap

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement from the replica:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

      Copy to Clipboard Toggle word wrap

2. Demote the instance:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication demote --suffix "dc=example,dc=com" --newrole "hub_or_consumer"

   Copy to Clipboard Toggle word wrap

   Depending on the role you want to configure, set the --newrole parameter to hub or consumer.

3. If you configured the replica as a hub and it should send updates to other hosts in the topology, create replication agreements.

Procedure

1. If the replica to demote has replication agreements that are no longer needed, for example, because you demote the replica to a consumer, remove the replication agreements:

   1. Navigate to Replication → Agreements.
   2. Click Actions next to the agreement you want to delete, and select Delete Agreement.
2. Navigate to Replication → Configuration, and click Change Role button.
3. Select the new replica role.
4. Select Yes, I am sure.
5. Click Change Role.
6. If the replica in its new role should send updates to other hosts in the topology, create replication agreements.

Procedure

1. Configure change log trimming:

   • To set a maximum age of changelog entries, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-age "4w"

     Copy to Clipboard Toggle word wrap

     This command sets the maximum age to 4 weeks. The parameter supports the following units:

     • s (S) for seconds
     • m (M) for minutes
     • h (H) for hours
     • d (D) for days
     • w (W) for weeks

   • To set a maximum number of entries, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-entries "100000"

     Copy to Clipboard Toggle word wrap

     This command sets the maximum number of entries in the changelog to 100,000.

2. By default, Directory Server trims the changelog every 5 minutes (300 seconds). To set a different interval, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --trim-interval 600

   Copy to Clipboard Toggle word wrap

   This command sets the interval to 10 minutes (600 seconds).

Procedure

1. Optional: Display the size of the changelog:

   1. Identify the back-end database of the dc=example,dc=com suffix:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
      dc=example,dc=com (userroot)

      Copy to Clipboard Toggle word wrap

      The name in parentheses is the back-end database that stores the data of the corresponding suffix.

   2. Display the size of the changelog file of the userroot backend:

      # ls -lh /var/lib/dirsrv/slapd-instance_name/db/userroot/replication_changelog.db
      -rw-------. 1 dirsrv dirsrv 517M Jul  5 12:58 /var/lib/dirsrv/slapd-instance_name/db/userroot/replication_changelog.db

      Copy to Clipboard Toggle word wrap

2. To be able to reset the parameters after reducing the changelog size, display and note the current values of the corresponding parameters:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication get-changelog --suffix "dc=example,dc=com"
   dn: cn=changelog,cn=userroot,cn=ldbm database,cn=plugins,cn=config
   cn: changelog
   nsslapd-changelogmaxage: 4w
   nsslapd-changelogtrim-interval: 300

   Copy to Clipboard Toggle word wrap

   If you do not see any specific attributes in the output, Directory Server uses their default values.

3. Temporarily, reduce trimming-related parameters:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-age "300s" --max-entries 500 --trim-interval 60

   Copy to Clipboard Toggle word wrap
   Important

   For performance reasons, do not permanently use too short interval settings.

4. Wait until the time set in the --trim-interval parameter expires.

5. Compact the changelog to regain disk space:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend compact-db --only-changelog

   Copy to Clipboard Toggle word wrap

6. Reset the changelog parameters to the values they had before you temporarily reduced them:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-age "4w" --trim-interval 300

   Copy to Clipboard Toggle word wrap

Procedure

1. Export the changelog, for example, to the /tmp/changelog.ldif file:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication export-changelog to-ldif -o /tmp/changelog.ldif -r "dc=example,dc=com"

   Copy to Clipboard Toggle word wrap

2. Enable change log encryption for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication --suffix "dc=example,dc=com" --encrypt

   Copy to Clipboard Toggle word wrap

3. Import the changelog from the /tmp/changelog.ldif file:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication import-changelog from-ldif -r "dc=example,dc=com" /tmp/changelog.ldif

   Copy to Clipboard Toggle word wrap

4. Restart the instance:

   # dsctl instance_name restart

   Copy to Clipboard Toggle word wrap

Verification

1. Make a change in the LDAP directory, such as updating an entry.

2. Stop the instance:

   # dsctl instance_name stop

   Copy to Clipboard Toggle word wrap

3. List the suffixes and their corresponding databases:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   dc=example,dc=com (userroot)

   Copy to Clipboard Toggle word wrap

   Note the name of the database for which you enabled changelog encryption.

4. Enter the following command to display parts of the changelog:

   # dbscan -f /var/lib/dirsrv/slapd-instance_name/db/userroot/replication_changelog.db | tail -50

   Copy to Clipboard Toggle word wrap

   If the changelog is encrypted, you see only encrypted data.

5. Start the instance.

   # dsctl instance_name start

   Copy to Clipboard Toggle word wrap

Procedure

1. Display the current error log level:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-errorlog-level
   nsslapd-errorlog-level: 16384

   Copy to Clipboard Toggle word wrap

2. The value to enable replication debugging is 8192. Set the nsslapd-errorlog-level parameter to 24576 (8192 + the previous value 16384) to enable replication debugging in addition to the currently enabled error logging features:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-errorlog-level=24576

   Copy to Clipboard Toggle word wrap

Procedure

1. Use the dsconf utility to configure the fractional replication:

   # dsconf -D "cn=Directory Manager" instance_name repl-agmt set example_agreement --suffix="dc=example,dc=com" --frac-list="authorityRevocationList accountUnlockTime memberof" --frac-list-total="accountUnlockTime"

   Copy to Clipboard Toggle word wrap

   The command excludes the authorityRevocationList, accountUnlockTime, and memberof attributes from incremental updates and excludes only accountUnlockTime from total updates.

   NOTE

   If you want to exclude the same list of attributes from total and incremental updates, add the list of excluded attributes only to the nsDS5ReplicatedAttributeList configuration attribute using the --frac-list option.

2. Optional: If you want to prevent empty replication updates, use the --strip-list option to add attributes that Directory Server removes from replication. For details, see Preventing empty updates in fractional replication.

Procedure

1. Navigate to Replication → Agreements.
2. Click the Options menu (⫶) of the agreement, where you want to configure the fractional replication, and select Edit to open the wizard window.

3. Open the Fractional Settings tab and set the following fields:

   • If you want to exclude the same attributes from total and incremental updates, add these attributes only to the Exclude Attributes field.

   • If you want to exclude different attributes from total and incremental updates:

     1. Add attributes excluded from incremental updates to the Exclude Attributes field that configures the nsDS5ReplicatedAttributeList parameter.
     2. Add attributes excluded from total (initial) updates to the Exclude Init Attributes field that configures the nsDS5ReplicatedAttributeListTotal parameter.
4. Optional: If you want to prevent empty replication updates, add attributes that Directory Server removes from replication to the Strip Attributes field.
5. Click Save Agreement button.

Procedure

1. Use dsconf utility to tune the fractional replication:

   # dsconf -D "cn=Directory Manager" instance_name repl-agmt set example_agreement \
       --suffix="dc=example,dc=com" --strip-list="modifiersname \
       modifytimestamp internalmodifiersname"
   Successfully updated agreement

   Copy to Clipboard Toggle word wrap

Procedure

1. Use the ldapsearch utility to find the keep-alive entry:

   # ldapsearch -D "cn=Directory Manager" -b "dc=example,dc=com" -W -H ldap://server.example.com -x 'objectClass=ldapsubentry'
   Enter LDAP Password: password
   
   # repl keep alive 1, example.com
   dn: cn=repl keep alive 1,dc=example,dc=com
   keepalivetimestamp: 20250204204708Z
   objectClass: top
   objectClass: ldapsubentry
   objectClass: extensibleObject
   cn: repl keep alive 1

   Copy to Clipboard Toggle word wrap

   Each keep-alive entry is specific to a given supplier and contains the replica ID of the supplier in the distinguished name (DN). In the example, the replica ID is 1.

Procedure

1. Optional: Create the ~/.dsrc file.

2. In the ~/.dsrc file, set the bind DNs, and passwords. For example:

   [repl-monitor-connections]
   connection1 = server1.example.com:389:cn=Directory Manager:*
   connection2 = server2.example.com:389:cn=Directory Manager:[~/pwd.txt]
   connection3 = hub1.example.com:389:cn=Directory Manager:S3cret

   Copy to Clipboard Toggle word wrap

   This example uses connection1 to connection3 as keys for each entry. However, you can use any unique key.

   When you run the dsconf replication monitor command, the dsconf utility connects to all servers configured in replication agreements of the instance. If the utility finds the hostname in ~/.dsrc, it uses the defined credentials to authenticate to the remote server. In the example above, dsconf uses the following credentials when connecting to a server:

   Expand

   Hostname	Bind DN	Password setup method
   server1.example.com	cn=Directory Manager	Requests the password
   server2.example.com	cn=Directory Manager	Reads the password from ~/pwd.txt
   hub1.example.com	cn=Directory Manager	S3cret

   Show more

Procedure

1. Navigate to Monitoring → Replication. The Replication Monitoring page opens.
2. Click Generate Report.

3. Enter the passwords for login to remote instances and click Confirm Credentials Input. Directory Server uses bind DNs values from existing replication agreements.

   The replication topology report will be generated on the Report Result tab.

   Note

   To generate another replication topology report, go to the Prepare Report tab.

Procedure

1. Navigate to Monitoring → Replication. The Replication Monitoring page opens.
2. Click Add Credentials.

3. Enter replication login credentials you want to use for authentication to remote instances:

   • Hostname. A remote instance hostname you want the server to authenticate to.
   • Port. A remote instance port.
   • Bind DN. Bind DN used for authentication to the remote instance.
   • Password. A password used for authentication.
   • Interactive Input. If checked, Directory Server will ask for a password every time you generate a replication topology report.
4. Click Save.

Procedure

1. Navigate to Monitoring → Replication. The Replication Monitoring page opens.
2. Click Add Alias.

3. Enter alias details:

   • Alias. An alias that will be displayed in the replication topology report.
   • Hostname. An instance hostname.
   • Port. An instance port.
4. Click Save.

Procedure

1. On the supplier, list the suffixes and their corresponding databases:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com backend suffix list
   dc=example,dc=com (userroot)
   o=test (test_database)

   Copy to Clipboard Toggle word wrap

   Note the name or suffix of the database you want to compare.

2. Export the database while the instance is running:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com backend export -r -l /var/lib/dirsrv/slapd-instance_name/ldif/export-supplier.ldif userRoot

   Copy to Clipboard Toggle word wrap

   The -r parameter ensures that the export includes replication state information, and -l sets the path to the export file. Note that the dirsrv user must have write permissions in the destination directory to create that file.

3. Repeat the previous steps on the replica you want to compare with the supplier.

4. Copy the exported file from one host to the other. For example, to copy the LDIF file from replica.example.com to supplier.example.com, enter the following command on the replica:

   # scp /var/lib/dirsrv/slapd-instance_name/ldif/export-replica.ldif supplier.example.com:/var/lib/dirsrv/slapd-instance_name/ldif/

   Copy to Clipboard Toggle word wrap

   Note that this command requires that you can access the supplier using SSH.

5. On the supplier, compare the two LDIF files:

   # ds-replcheck offline -m /var/lib/dirsrv/slapd-instance_name/ldif/export-supplier.ldif -r /var/lib/dirsrv/slapd-instance_name/ldif/export-replica.ldif -rid 1 -b "dc=example,dc=com"

   Copy to Clipboard Toggle word wrap

   The -m and -r parameters set the paths to the supplier and replica, and -rid sets the replica identifier of the supplier.