Configuring and managing replication

Procedure

1. Enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 1

   This command configures the supplier.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this entry to 1.

   Important

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. Add the replication agreement and initialize the consumer:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt create --suffix "dc=example,dc=com" --host "consumer.example.com" --port 389 --conn-protocol=LDAP --bind-dn "cn=replication manager,cn=config" --bind-passwd "password" --bind-method=SIMPLE --init example-agreement

   This command creates a replication agreement named example-agreement. The replication agreement defines settings, such as the consumer’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to this consumer.

   After the agreement was created, Directory Server initializes consumer.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Display the replication configuration:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication get --suffix "dc=example,dc=com"
   dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
   ...
   nsDS5ReplicaRoot: dc=example,dc=com
   nsDS5ReplicaType: 3
   ...

   These parameters indicate:

   • nsDS5ReplicaRoot sets the suffix that is replicated.
   • nsDS5ReplicaType set to 3 defines that this host is a supplier.

2. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement
   Agreement successfully initialized.

3. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement
   Status For Agreement: "example-agreement" (consumer.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210330075608Z
   Last Update End: 20210330075608Z
   Number Of Changes Sent: 1:3/0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210330074603Z
   Last Init End: 20210330074606Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (6062d73c000000010000) consumer (Unavailable) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com config replace nsslapd-idletimeout=7200

   To set an unlimited period, set nsslapd-idletimeout to 0.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. Click Enable Replication.

4. Select Consumer in the Replication Role field, and enter the replication manager account and the password to create:

   

   These settings configure the host as a consumer for the dc=example,dc=com suffix. Additionally, the server creates the cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

5. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Consumer, replication is enabled, and the host is configured as a consumer.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, replication manager credentials, and leave the Bind Group DN field empty:

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 1.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

   3. Click Enable Replication.

4. Add a replication agreement and initialize the consumer:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      These settings create a replication agreement named example-agreement. The replication agreement defines settings, such as the consumer’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to this consumer.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the consumer after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes consumer.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

Procedure

1. Enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 2 --bind-dn "cn=replication manager,cn=config" --bind-passwd "password"

   This command configures the supplier1.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this entry to 2. Additionally, the command creates the cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

   Important

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. Add the replication agreement and initialize the new server:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com repl-agmt create --suffix "dc=example,dc=com" --host "supplier2.example.com" --port 389 --conn-protocol LDAP --bind-dn "cn=replication manager,cn=config" --bind-passwd "password" --bind-method SIMPLE --init example-agreement-supplier1-to-supplier2

   This command creates a replication agreement named example-agreement-supplier1-to-supplier2. The replication agreement defines settings, such as the new supplier’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the new supplier.

   After the agreement was created, Directory Server initializes supplier2.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Display the replication configuration:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com replication get --suffix "dc=example,dc=com"
   dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
   ...
   nsDS5ReplicaBindDN: cn=replication manager,cn=config
   nsDS5ReplicaRoot: dc=example,dc=com
   nsDS5ReplicaType: 3
   ...

   These parameters indicate:

   • nsDS5ReplicaBindDN specifies the replication manager account.
   • nsDS5ReplicaRoot sets the suffix that is replicated.
   • nsDS5ReplicaType set to 3 defines that this host is a supplier.

2. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-supplier1-to-supplier2
   Agreement successfully initialized.

3. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-supplier1-to-supplier2
   Status For Agreement: "example-agreement-supplier1-to-supplier2" (supplier2.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331071545Z
   Last Update End: 20210331071546Z
   Number Of Changes Sent: 2:1/0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331071541Z
   Last Init End: 20210331071544Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (6064219e000100020000) consumer (Unavailable) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com config replace nsslapd-idletimeout=7200

   To set an unlimited period, set nsslapd-idletimeout to 0.

Verification

1. Display the agreement status:

   # dsconf -D "cn=Directory Manager" ldap://supplier2.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-supplier2-to-supplier1
   Agreement successfully initialized.

2. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier2.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-supplier2-to-supplier1
   Status For Agreement: ""example-agreement-supplier2-to-supplier1 (supplier1.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331073540Z
   Last Update End: 20210331073540Z
   Number Of Changes Sent: 7:1/0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331073535Z
   Last Init End: 20210331073539Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (60642649000000070000) consumer (Unavailable) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier2.example.com config replace nsslapd-idletimeout=7200

   To set an unlimited period, set nsslapd-idletimeout to 0.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, as well as the distinguished name (DN) and password of the replication manager account to create:

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 1.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

      If you set no replication manager DN, set a bind group DN. You can then use any member of this group in the replication agreement.

   3. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Supplier, replication is enabled, and the host is configured as a supplier.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, as well as the distinguished name (DN) and password of the replication manager account to create:

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 2.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

   3. Click Enable Replication.

4. Add a replication agreement and initialize the new server:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      These settings create a replication agreement named example-agreement-supplier1-to-supplier2. The replication agreement defines settings, such as the new supplier’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the new supplier.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the new server after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes supplier2.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Add a replication agreement and initialize the existing server:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      These settings create a replication agreement named example-agreement-supplier2-to-supplier1. The replication agreement defines settings, such as the existing server’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the existing supplier.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the new server after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes supplier1.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

Procedure

1. Create the ou=services entry if it does not exist:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: ou=services,dc=example,dc=com
   objectClass: organizationalunit
   objectClass: top
   ou: services

2. Create accounts for both servers, such as cn=server1,ou=services,dc=example,dc=com and cn=server1,ou=services,dc=example,dc=com:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: cn=server1,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server1
   cn: server1
   userPassword: password
   userCertificate:< file:///root/server1.der
   
   adding new entry "cn=server1,ou=services,dc=example,dc=com"
   
   dn: cn=server2,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server2
   cn: server2
   userPassword: password
   userCertificate:< file:///root/server2.der
   
   adding new entry "cn=server2,ou=services,dc=example,dc=com"

3. Create a group, such as cn=repl_servers,dc=groups,dc=example,dc=com:

   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group create --cn "repl_servers"

4. Add the two replication accounts as members to the group:

   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group add_member repl_servers "cn=server1,ou=services,dc=example,dc=com"
   
   # dsidm -D "cn=Directory Manager" ldaps://server1.example.com -b "dc=example,dc=com" group add_member repl_servers "cn=server2,ou=services,dc=example,dc=com"

Procedure

1. On server2.example.com, enable replication for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 2 --bind-dn "cn=replication manager,cn=config" --bind-passwd "password"

   This command configures the server2.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this host to 2. Additionally, the command creates a temporary cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. On server1.example.com:

   1. Enable replication:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication enable --suffix="dc=example,dc=com" --role="supplier" --replica-id="1"

   2. Create a temporary replication agreement which uses the temporary account from the previous step for authentication:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-dn="cn=Replication Manager,cn=config" --bind-passwd="password" --bind-method=SIMPLE --init temporary_agreement

Verification

1. Verify that the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt init-status --suffix "dc=example,dc=com" temporary_agreement
   Agreement successfully initialized.

Procedure

1. On server1.example.com:

   1. Remove the temporary replication agreement:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt delete --suffix="dc=example,dc=com" temporary_agreement

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf -D "cn=Directory Manager" ldaps://server1.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

2. On server2.example.com:

   1. Remove the temporary replication manager account:

      # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication delete-manager --suffix="dc=example,dc=com" --name="Replication Manager"

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf -D "cn=Directory Manager" ldaps://server2.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf -D "cn=Directory Manager" ldap://server2.example.com replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

   4. Create the replication agreement with certificate-based authentication:

      dsconf -D "cn=Directory Manager" ldaps://server2.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server2-to-server1

3. On server1.example.com, create the replication agreement with certificate-based authentication:

   dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt create --suffix="dc=example,dc=com" --host="server2.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server1-to-server2

Verification

1. Verify on each server that the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldaps://server1.example.com repl-agmt init-status --suffix "dc=example,dc=com" server1-to-server2
   Agreement successfully initialized.
   
   # dsconf -D "cn=Directory Manager" ldaps://server2.example.com repl-agmt init-status --suffix "dc=example,dc=com" server2-to-server1
   Agreement successfully initialized.

Procedure

1. Enable replication for the dc=example,dc=com suffix:

   # [command]`dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 1

   This command configures the supplier.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this entry to 1.

   Important

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. Add the replication agreement and initialize the new server:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt create --suffix "dc=example,dc=com" --host "hub.example.com" --port 389 --conn-protocol LDAP --bind-dn "cn=replication manager,cn=config" --bind-passwd "password" --bind-method SIMPLE --init example-agreement-supplier-to-hub

   This command creates a replication agreement named example-agreement-supplier-to-hub. The replication agreement defines settings, such as the hub’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to the hub.

   After the agreement was created, Directory Server initializes hub.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Display the replication configuration:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication get --suffix "dc=example,dc=com"
   dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
   ...
   nsDS5ReplicaRoot: dc=example,dc=com
   nsDS5ReplicaType: 3
   ...

   These parameters indicate:

   • nsDS5ReplicaRoot sets the suffix that is replicated.
   • nsDS5ReplicaType set to 3 defines that this host is a supplier.

2. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-supplier-to-hub
   Agreement successfully initialized.

3. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-supplier-to-hub
   Status For Agreement: "example-agreement-supplier-to-hub" (hub.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331105030Z
   Last Update End: 20210331105030Z
   Number Of Changes Sent: 0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331105026Z
   Last Init End: 20210331105029Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (Unknown) consumer (Unknown) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://supplier1.example.com config replace nsslapd-idletimeout=7200

   To set an unlimited period, set nsslapd-idletimeout to 0.

Verification

1. Verify whether the initialization was successful:

   # dsconf -D "cn=Directory Manager" ldap://hub.example.com repl-agmt init-status --suffix "dc=example,dc=com" example-agreement-hub-to-consumer
   Agreement successfully initialized.

2. Display the replication status:

   # dsconf -D "cn=Directory Manager" ldap://hub.example.com repl-agmt status --suffix "dc=example,dc=com" example-agreement-hub-to-consumer
   Status For Agreement: "example-agreement-hub-to-consumer" (consumer.example.com:389)
   Replica Enabled: on
   Update In Progress: FALSE
   Last Update Start: 20210331131534Z
   Last Update End: 20210331131534Z
   Number Of Changes Sent: 0
   Number Of Changes Skipped: None
   Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
   Last Init Start: 20210331131530Z
   Last Init End: 20210331131533Z
   Last Init Status: Error (0) Total update succeeded
   Reap Active: 0
   Replication Status: Not in Synchronization: supplier (Unknown) consumer (Unknown) State (green) Reason (error (0) replica acquired successfully: incremental update succeeded)
   Replication Lag Time: Unavailable

   Verify the Replication Status and Last Update Status fields.

Troubleshooting

1. By default, the replication idle timeout for all agreements on a server is 1 hour. If the initialization of large databases fails due to timeouts, set the nsslapd-idletimeout parameter to a higher value. For example, to set the parameter to 7200 (2 hours), enter:

   # dsconf -D "cn=Directory Manager" ldap://hub .example.com config replace nsslapd-idletimeout=7200

   To set an unlimited period, set nsslapd-idletimeout to 0.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Consumer in the Replication Role field, and enter the replication manager account and the password to create:

      

      These settings configure the host as a hub for the dc=example,dc=com suffix.

   3. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Hub, replication is enabled, and the host is configured as a consumer.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Enable replication:

   1. Click Enable Replication.

   2. Select Supplier in the Replication Role field, enter a replica ID, as well as the distinguished name (DN) and password of the replication manager account to create:

      

      These settings configure the host as a supplier for the dc=example,dc=com suffix and set the replica ID of this entry to 1.

      Important

      The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

   3. Click Enable Replication.

4. Add a replication agreement and initialize the new server:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      These settings create a replication agreement named example-agreement-supplier-to-hub. The replication agreement defines settings, such as the hub’s host name, protocol, and authentication information that the supplier uses when connecting and replicating data to this hub.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the new server after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes hub.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. Click Enable Replication.

4. Select Consumer in the Replication Role field, and enter the replication manager account and the password to create:

   

   These settings configure the host as a consumer for the dc=example,dc=com suffix. Additionally, the server creates the cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

5. Click Enable Replication.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. If the Replica Role field contains the value Consumer, replication is enabled, and the host is configured as a consumer.

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. Add a replication agreement and initialize the consumer:

   1. On the Agreements tab, click Create Agreement, and fill the fields:

      

      These settings create a replication agreement named example-agreement-hub-to-consumer. The replication agreement defines settings, such as the consumer’s host name, protocol, and authentication information that the hub uses when connecting and replicating data to this consumer.

   2. Select Do Online Initialization in the Consumer Initialization field to automatically initialize the consumer after saving the agreement.

   3. Click Save Agreement.

      After the agreement was created, Directory Server initializes consumer.example.com. Depending on the amount of data to replicate, initialization can be time-consuming.

Verification

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.

3. On the Agreements tab, verify the status of the agreement in the State column of the table.

   

Procedure

1. Set the timeout value for the suffix:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication set --suffix="dc=example,dc=com" --repl-release-timeout=70

   This command changes the replication timeout of the example,dc=com suffix to 70 seconds.

2. Restart the instance:

   # dsctl instance_name restart

Procedure

1. On the Replication tab, select the suffix entry.
2. Click Show Advanced Settings.
3. Update the value in the Replication Release Timeout field.
4. Click Save Configuration.

Procedure

1. On the consumer or hub to remove:

   1. List the suffixes and their corresponding databases:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix list
      dc=example,dc=com (userroot)

      Note the name of the databases.

   2. Set the databases into read-only mode to prevent any further updates:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix set --enable-readonly "userroot"

2. On all suppliers that have a replication agreement with the consumer or hub you want to remove:

   1. List the replication agreements for the suffix that is replicated:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

3. On the consumer or hub to remove, disable replication for all suffixes:

   # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com replication disable --suffix "dc=example,dc=com"

   If this host was a hub, disabling replication automatically also deletes all replication agreements for this suffix on this server.

Procedure

1. On the supplier to remove:

   1. List the suffixes and their corresponding databases:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix list
      dc=example,dc=com (userroot)

      Note the name of the databases.

   2. Set the databases into read-only mode to prevent any further updates:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com backend suffix set --enable-readonly "userroot"

   3. Wait until all other servers in the topology received all data from this supplier. To verify, ensure that the CSN on other servers is equal or greater than the CSN on the supplier to remove:

      # ds-replcheck online -D "cn=Directory Manager" -w password -m ldap://host-to-remove.example.com:389 -r ldap://server.example.com:389 -b dc=example,dc=com
      ================================================================================
               Replication Synchronization Report  (Tue Mar  5 09:46:20 2021)
      ================================================================================
      
      Database RUV's
      =====================================================
      
      Supplier RUV:
        {replica 1 ldap://host-to-remove.example.com:389} 5c7e8927000100010000 5c7e89a0000100010000
        {replicageneration} 5c7e8927000000010000
      
      Replica RUV:
        {replica 1 ldap://host-to-remove.example.com:389} 5c7e8927000100010000 5c7e8927000400010000
        {replica 2 ldap://server.example.com:389}
        {replicageneration} 5c7e8927000000010000

   4. Display the replica ID:

      # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com replication get --suffix "dc=example,dc=com" | grep -i "nsds5replicaid"
      nsDS5ReplicaId: 1

      In this example, the replica ID is 1. Remember your replica ID for the last step of this procedure.

2. On all suppliers that have a replication agreement with the host you want to remove:

   1. List the replication agreements for the suffix that is replicated:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

3. On the supplier to remove, disable replication for all suffixes:

   # dsconf -D "cn=Directory Manager" ldap://host-to-remove.example.com replication disable --suffix "dc=example,dc=com"

   Disabling replication automatically also deletes all replication agreements for this suffix on this server.

4. Before you proceed, ensure that all Directory Server instances listed in the Replica RUV section of the ds-replcheck output are online.

5. On one of the remaining suppliers in the topology, clean the RUVs for the replica ID:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-tasks cleanallruv --suffix "dc=example,dc=com" --replica-id 1

   This command requires that you specify the replica ID displayed in an earlier step of this procedure.

Procedure

1. Enable replication logging:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-errorlog-level=8192

   Note that this command enables only replication logging, and logging other error messages is disabled.

2. Monitor the /var/log/dirsrv/slapd-instance_name/errors log file and search for the following error message:

   Replica Busy! Status: [Error (1) Replication error acquiring replica: replica busy]

   Note that it is normal if Directory Server occasionally logs this error. However, if replicas frequently do not receive updates, and the suppliers log this error, consider updating your configuration to solve this problem.

Procedure

1. Set the nsds5ReplicaBusyWaitTime parameter to configure the time a supplier waits before starting another attempt to acquire access to a replica after the replica sent a busy response:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt set --suffix "dc=example,dc=com" --busy-wait-time 5 replication_agreement_name

   This command sets the time to wait to 5 seconds. This setting applies only to the specified replication agreement.

2. Set the nsds5ReplicaSessionPauseTime parameter to configure the time a supplier waits between two update sessions:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt set --suffix "dc=example,dc=com" --session-pause-time 15 replication_agreement_name

   This command sets the pause to 15 seconds. By default, nsds5ReplicaSessionPauseTime is one second longer than the value in nsds5ReplicaBusyWaitTime. This setting applies only to the specified replication agreement.

3. Set the nsds5ReplicaReleaseTimeout parameter to terminate replication sessions after a given amount of time regardless of whether or not sending the update is complete:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication set --suffix "dc=example,dc=com" --repl-release-timeout 90

   This command sets the timeout to 90 seconds. This setting applies to all replication agreements for the specified suffix.

4. Optional: Set a timeout period for a supplier so that it does not stay connected to a consumer infinitely attempting to send updates over a slow or broken connection:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com repl-agmt set --conn-timeout 600 --suffix "dc=example,dc=com" replication_agreement_name

   This command sets the timeout to 600 seconds (10 minutes). To identify the optimum value, check the access log for the average amount of time the replication process takes, and set the timeout period accordingly.

Procedure

1. Check if the replication agreement has an update schedule configured:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt get --suffix "dc=example,dc=com" example-agreement

   If the output of the command contains nsDS5ReplicaUpdateSchedule: * or the nsDS5ReplicaUpdateSchedule parameter is not present, no update schedule is configured.

   If nsDS5ReplicaUpdateSchedule contains a schedule, such as shown in the following, note the value:

   nsDS5ReplicaUpdateSchedule: 0800-2200 0246

2. If an update schedule is configured, enter the following command to temporary disable it:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt set --schedule \* --suffix "dc=example,dc=com" example-agreement

3. Temporarily disable the replication agreement:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt disable --suffix "dc=example,dc=com" example-agreement

4. Re-enable the replication agreement to force the replication update:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt enable --suffix "dc=example,dc=com" example-agreement

5. If a replication schedule was configured at the beginning of this procedure, set the schedule to the previous value:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt set --schedule "0800-2200 0246" --suffix "dc=example,dc=com" example-agreement

Procedure

1. Open the Replication menu.
2. Select the dc=example,dc=com suffix.
3. Open the Agreements tab.

4. Check if the replication agreement has an update schedule configured:

   1. Click the overflow menu next to the agreement, and select Edit Agreement.

   2. On the Scheduling tab, note the values that are currently set.

      

      If Use A Custom Schedule is not selected, no schedule is configured.

5. Click the overflow menu next to the replication agreement, and select Disable/Enable Agreement to disable the agreement.

   The status of the agreement in the State column is now Disabled.

6. Click the overflow menu next to the replication agreement again, and select Disable/Enable Agreement to re-enable the replication agreement and enforce the replication update.

   The status of the agreement in the State column is now Enabled.

7. If a replication schedule was configured at the beginning of this procedure, set the schedule to the previous values:

   1. Click click the overflow menu, and select Actions → Edit Agreement.
   2. On the Scheduling tab, set the previous values.

Procedure

1. If the replica to promote is a hub with replication agreements, and the hub should no longer send data to other hosts after the promotion, remove the replication agreements:

   1. List the replication agreements on the hub:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement from the hub:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

2. Promote the instance:

   • If you promote a consumer or hub to a supplier, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication promote --suffix "dc=example,dc=com" --newrole "supplier" --replica-id 2

     Important

     The replica ID must be a unique integer value between 1 and 65534 for a suffix across all suppliers in the topology.

   • If you promote a consumer to a hub, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication promote --suffix "dc=example,dc=com" --newrole "hub"

3. If the replica in its new role should send updates to other hosts in the topology, create replication agreements.

Procedure

1. If the replica to promote is a hub with replication agreements, and the hub should no longer send data to other hosts after the promotion, remove the replication agreements:

   1. Navigate to Replication → Agreements.
   2. Click Actions next to the agreement you want to delete, and select Delete Agreement.

2. Navigate to Replication → Configuration, and click the Change Role button.

   • If you promote a consumer or hub to a supplier, select Supplier, and enter a unique replica ID.

     Important

     The replica ID must be a unique integer value between 1 and 65534 for a suffix across all suppliers in the topology.

   • If you promote a consumer to a hub, select Hub.
3. Select Yes, I am sure.
4. Click Change Role.
5. If the replica in its new role should send updates to other hosts in the topology, create replication agreements.

Procedure

1. If the replica to demote has replication agreements that are no longer needed, for example, because you demote the replica to a consumer, remove the replication agreements:

   1. List the replication agreements on the replica:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt list --suffix "dc=example,dc=com"
      dn: cn=example-agreement,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
      cn: example-agreement
      ...

      The cn attribute contains the replication agreement name that you need in the next step.

   2. Remove the replication agreement from the replica:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-agmt delete --suffix "dc=example,dc=com" example-agreement

2. Demote the instance:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication demote --suffix "dc=example,dc=com" --newrole "hub_or_consumer"

   Depending on the role you want to configure, set the --newrole parameter to hub or consumer.

3. If you configured the replica as a hub and it should send updates to other hosts in the topology, create replication agreements.

Procedure

1. If the replica to demote has replication agreements that are no longer needed, for example, because you demote the replica to a consumer, remove the replication agreements:

   1. Navigate to Replication → Agreements.
   2. Click Actions next to the agreement you want to delete, and select Delete Agreement.
2. Navigate to Replication → Configuration, and click Change Role button.
3. Select the new replica role.
4. Select Yes, I am sure.
5. Click Change Role.
6. If the replica in its new role should send updates to other hosts in the topology, create replication agreements.

Procedure

1. Configure change log trimming:

   • To set a maximum age of changelog entries, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-age "4w"

     This command sets the maximum age to 4 weeks. The parameter supports the following units:

     • s (S) for seconds
     • m (M) for minutes
     • h (H) for hours
     • d (D) for days
     • w (W) for weeks

   • To set a maximum number of entries, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-entries "100000"

     This command sets the maximum number of entries in the changelog to 100,000.

2. By default, Directory Server trims the changelog every 5 minutes (300 seconds). To set a different interval, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --trim-interval 600

   This command sets the interval to 10 minutes (600 seconds).

Procedure

1. Optional: Display the size of the changelog:

   1. Identify the back-end database of the dc=example,dc=com suffix:

      # dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
      dc=example,dc=com (userroot)

      The name in parentheses is the back-end database that stores the data of the corresponding suffix.

   2. Display the size of the changelog file of the userroot backend:

      # ls -lh /var/lib/dirsrv/slapd-instance_name/db/userroot/replication_changelog.db
      -rw-------. 1 dirsrv dirsrv 517M Jul  5 12:58 /var/lib/dirsrv/slapd-instance_name/db/userroot/replication_changelog.db

2. To be able to reset the parameters after reducing the changelog size, display and note the current values of the corresponding parameters:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication get-changelog --suffix "dc=example,dc=com"
   dn: cn=changelog,cn=userroot,cn=ldbm database,cn=plugins,cn=config
   cn: changelog
   nsslapd-changelogmaxage: 4w
   nsslapd-changelogtrim-interval: 300

   If you do not see any specific attributes in the output, Directory Server uses their default values.

3. Temporarily, reduce trimming-related parameters:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-age "300s" --max-entries 500 --trim-interval 60

   Important

   For performance reasons, do not permanently use too short interval settings.

4. Wait until the time set in the --trim-interval parameter expires.

5. Compact the changelog to regain disk space:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend compact-db --only-changelog

6. Reset the changelog parameters to the values they had before you temporarily reduced them:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication set-changelog --suffix "dc=example,dc=com" --max-age "4w" --trim-interval 300

Procedure

1. Export the changelog, for example, to the /tmp/changelog.ldif file:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication export-changelog to-ldif -o /tmp/changelog.ldif -r "dc=example,dc=com"

2. Enable change log encryption for the dc=example,dc=com suffix:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication --suffix "dc=example,dc=com" --encrypt

3. Import the changelog from the /tmp/changelog.ldif file:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com replication import-changelog from-ldif -r "dc=example,dc=com" /tmp/changelog.ldif

4. Restart the instance:

   # dsctl instance_name restart

Verification

1. Make a change in the LDAP directory, such as updating an entry.

2. Stop the instance:

   # dsctl instance_name stop

3. List the suffixes and their corresponding databases:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   dc=example,dc=com (userroot)

   Note the name of the database for which you enabled changelog encryption.

4. Enter the following command to display parts of the changelog:

   # dbscan -f /var/lib/dirsrv/slapd-instance_name/db/userroot/replication_changelog.db | tail -50

   If the changelog is encrypted, you see only encrypted data.

5. Start the instance.

   # dsctl instance_name start

Procedure

1. Display the current error log level:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-errorlog-level
   nsslapd-errorlog-level: 16384

2. The value to enable replication debugging is 8192. Set the nsslapd-errorlog-level parameter to 24576 (8192 + the previous value 16384) to enable replication debugging in addition to the currently enabled error logging features:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-errorlog-level=24576

Procedure

1. Optional: Create the ~/.dsrc file.

2. In the ~/.dsrc file, set the bind DNs, and passwords. For example:

   [repl-monitor-connections]
   connection1 = server1.example.com:389:cn=Directory Manager:*
   connection2 = server2.example.com:389:cn=Directory Manager:[~/pwd.txt]
   connection3 = hub1.example.com:389:cn=Directory Manager:S3cret

   This example uses connection1 to connection3 as keys for each entry. However, you can use any unique key.

   When you run the dsconf replication monitor command, the dsconf utility connects to all servers configured in replication agreements of the instance. If the utility finds the hostname in ~/.dsrc, it uses the defined credentials to authenticate to the remote server. In the example above, dsconf uses the following credentials when connecting to a server:

   Hostname	Bind DN	Password setup method
   server1.example.com	cn=Directory Manager	Requests the password
   server2.example.com	cn=Directory Manager	Reads the password from ~/pwd.txt
   hub1.example.com	cn=Directory Manager	S3cret

Procedure

1. Navigate to Monitoring → Replication. The Replication Monitoring page opens.
2. Click Generate Report.

3. Enter the passwords for login to remote instances and click Confirm Credentials Input. Directory Server uses bind DNs values from existing replication agreements.

   The replication topology report will be generated on the Report Result tab.

   Note

   To generate another replication topology report, go to the Prepare Report tab.

Procedure

1. Navigate to Monitoring → Replication. The Replication Monitoring page opens.
2. Click Add Credentials.

3. Enter replication login credentials you want to use for authentication to remote instances:

   • Hostname. A remote instance hostname you want the server to authenticate to.
   • Port. A remote instance port.
   • Bind DN. Bind DN used for authentication to the remote instance.
   • Password. A password used for authentication.
   • Interactive Input. If checked, Directory Server will ask for a password every time you generate a replication topology report.
4. Click Save.

Procedure

1. Navigate to Monitoring → Replication. The Replication Monitoring page opens.
2. Click Add Alias.

3. Enter alias details:

   • Alias. An alias that will be displayed in the replication topology report.
   • Hostname. An instance hostname.
   • Port. An instance port.
4. Click Save.

Procedure

1. On the supplier, list the suffixes and their corresponding databases:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com backend suffix list
   dc=example,dc=com (userroot)
   o=test (test_database)

   Note the name or suffix of the database you want to compare.

2. Export the database while the instance is running:

   # dsconf -D "cn=Directory Manager" ldap://supplier.example.com backend export -r -l /var/lib/dirsrv/slapd-instance_name/ldif/export-supplier.ldif userRoot

   The -r parameter ensures that the export includes replication state information, and -l sets the path to the export file. Note that the dirsrv user must have write permissions in the destination directory to create that file.

3. Repeat the previous steps on the replica you want to compare with the supplier.

4. Copy the exported file from one host to the other. For example, to copy the LDIF file from replica.example.com to supplier.example.com, enter the following command on the replica:

   # scp /var/lib/dirsrv/slapd-instance_name/ldif/export-replica.ldif supplier.example.com:/var/lib/dirsrv/slapd-instance_name/ldif/

   Note that this command requires that you can access the supplier using SSH.

5. On the supplier, compare the two LDIF files:

   # ds-replcheck offline -m /var/lib/dirsrv/slapd-instance_name/ldif/export-supplier.ldif -r /var/lib/dirsrv/slapd-instance_name/ldif/export-replica.ldif -rid 1 -b "dc=example,dc=com"

   The -m and -r parameters set the paths to the supplier and replica, and -rid sets the replica identifier of the supplier.

Procedure

1. List the conflict entries:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-conflict list dc=example,dc=com
   dn: nsuniqueid=a7f1758b-512211ec-b115e2e9-7dc2d46b+uid=user_name,ou=people,dc=example,dc=com
   cn: user_name
   displayName: user
   gidNumber: 99998
   homeDirectory: /var/empty
   legalName: user name
   loginShell: /bin/false
   nsds5replconflict: namingConflict (ADD) uid=user_name,ou=people,dc=example,dc=com
   objectClass: top
   objectClass: nsPerson
   objectClass: nsAccount
   objectClass: nsOrgPerson
   objectClass: posixAccount
   objectClass: ldapsubentry
   uid: user_name
   uidNumber: 99998

2. If conflict entries exist, decide how to proceed:

   • To keep only the valid entry (uid=user_name,ou=people,dc=example,dc=com) and delete the conflict entry, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-conflict delete nsuniqueid=a7f1758b-512211ec-b115e2e9-7dc2d46b+uid=user_name,ou=People,dc=example,dc=com

   • To keep only the conflict entry (nsuniqueid=a7f1758b-512211ec-b115e2e9-7dc2d46b+uid=user_name,ou=People,dc=example,dc=com) and delete the valid entry, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-conflict swap nsuniqueid=a7f1758b-512211ec-b115e2e9-7dc2d46b+uid=user_name,ou=People,dc=example,dc=com

   • To keep both entries, specify a new relative distinguished name (RDN) to rename the conflict entry:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-conflict convert --new-rdn=uid=user_name_NEW nsuniqueid=a7f1758b-512211ec-b115e2e9-7dc2d46b+uid=user_name,ou=people,dc=example,dc=com

     This command renames the conflict entry to uid=user_name_NEW,ou=people,dc=example,dc=com.

Procedure

1. List the orphan entry conflicts:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-conflict list-glue suffix
   dn: ou=parent,dc=example,dc=com
   objectClass: top
   objectClass: organizationalunit
   objectClass: glue
   objectClass: extensibleobject
   ou: parent

2. If orphan entry conflicts exist, decide how to proceed:

   • To delete a glue entry and its child entries, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-conflict delete-glue "ou=parent,dc=example,dc=com"
     dn: ou=parent,dc=example,dc=com
     objectClass: top
     objectClass: organizationalunit
     objectClass: extensibleobject
     ou: parent

   • To convert a glue entry into a regular entry, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com repl-conflict convert-glue "ou=parent,dc=example,dc=com"

Procedure

1. Monitor the /var/log/dirsrv/slapd-instance_name/errors log file and search for entries similar to the following:

   [22/Jan/2021:17:16:01 -0500] NSMMReplicationPlugin - ruv_compare_ruv: RUV [changelog max RUV] does not contain element [{replica 8 ldap://server2.example.com:389} 4aac3e59000000080000 4c6f2a02000000080000] which is present in RUV [database RUV]
   ...
   [22/Jan/2021:17:16:01 -0500] NSMMReplicationPlugin - replica_check_for_data_reload: Warning: for replica dc=example,dc=com there were some differences between the changelog max RUV and the database RUV. If there are obsolete elements in the database RUV, you should remove them using the CLEANALLRUV task. If they are not obsolete, you should check their status to see why there are no changes from those servers in the changelog.

   In this case, the replica ID 8 causes this error.

2. Display all RUV records and replica IDs, both valid and invalid:

   # dsconf -D "cn=Directory Manager" ldap://server1.example.com replication get-ruv --suffix "dc=example,dc=com"
   RUV:        {replica 1 ldap://server1.example.com} 61a4d8f8000100010000 61a4f5b8000000010000
   
   Replica ID: 1
   LDAP URL:   ldap://server1.example.com
   Min CSN:    2021-11-29 13:43:20 1 0 (61a4d8f8000100010000)
   Max CSN:    2021-11-29 15:46:00 (61a4f5b8000000010000)
   RUV:        {replica 2 ldap://server2.example.com} 61a4d8fb000100020000 61a4f550000000020000
   
   Replica ID: 2
   LDAP URL:   ldap://server2.example.com
   Min CSN:    2021-11-29 13:43:23 1 0 (61a4d8fb000100020000)
   Max CSN:    2021-11-29 15:44:16 (61a4f550000000020000)
    RUV:        {replica 8 ldap://server3.example.com} 61a4d903000100080000 61a4d908000000080000
   
   Replica ID: 8
   LDAP URL:   ldap://server3.example.com
   Min CSN:    2021-11-29 13:43:31 1 0 (61a4d903000100080000)
   Max CSN:    2021-11-29 13:43:36 (61a4d908000000080000)

   Note the list of returned replica IDs: 1, 2, and 8.

3. Run cleanup tasks for the replica IDs 8.

   # dsconf -D "cn=Directory Manager" ldap://server1.example.com repl-tasks cleanallruv --suffix="dc=example,dc=com" --replica-id=8

   Note that Directory Server replicates RUV cleanup tasks. Therefore, you need to start the tasks on only one supplier.

   If one of the replicas can not be joined, for example if it is down, you can use the --force-cleaning option to achieve an immediate clean up of the RUV.