4.4. Database Plug-in Attributes

The database plug-in is also organized in an information tree, as shown in Figure 4.1, “Database Plug-in”.

Figure 4.1. Database Plug-in

All plug-in technology used by the database instances is stored in the cn=ldbm database plug-in node. This section presents the additional attribute information for each of the nodes in bold in the cn=ldbm database,cn=plugins,cn=config information tree.

4.4.1. Database Attributes under cn=config,cn=ldbm database,cn=plugins,cn=config

This section covers global configuration attributes common to all instances are stored in the cn=config,cn=ldbm database,cn=plugins,cn=config tree node.

4.4.1.1. nsslapd-cache-autosize

This performance tuning-related attribute, which is turned off by default, specifies the percentage of free memory to use for all the combined caches. For example, if the value is set to 80, then 80 percent of the remaining free memory would be claimed for the cache. To run other servers on the machine, then set the value lower. Setting the value to 0 turns off the cache autosizing and uses the normal nsslapd-cachememsize and nsslapd-dbcachesize attributes.

Note

If the nsslapd-cache-autosize attribute and nsslapd-cache-autosize-split attribute are both set to high values, such as 100, then the Directory Server may fail to start and return an error message. To fix this issue, reset the nsslapd-cache-autosize and nsslapd-cache-autosize-split attributes to a more reasonable level. For example:

nsslapd-cache-autosize: 60
nsslapd-cache-autosize-split: 60

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 (turns cache autosizing off) to 100
Default Value	0
Syntax	Integer
Example	nsslapd-cache-autosize: 80

4.4.1.2. nsslapd-cache-autosize-split

This performance tuning-related attribute specifies the percentage of cache space to allocate to the database cache. For example, setting this to 60 would give the database cache 60 percent of the cache space and split the remaining 40 percent between the back end entry caches. That is, if there were two databases, each of them would receive 20 percent. This attribute only applies when the nsslapd-cache-autosize attribute has a value of 0.

Note

If the nsslapd-cache-autosize attribute and nsslapd-cache-autosize-split attribute are both set to high values, such as 100, then the Directory Server may fail to start and return error message. To fix this issue, reset the nsslapd-cache-autosize and nsslapd-cache-autosize-split attributes to a more reasonable level. For example:

nsslapd-cache-autosize: 60
nsslapd-cache-autosize-split: 60

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to 99
Default Value	50 (This will not necessarily optimize operations.)
Syntax	Integer
Example	nsslapd-cache-autosize-split: 50

4.4.1.3. nsslapd-dbcachesize

This performance tuning-related attribute specifies the database index cache size, in bytes. This is one of the most important values for controlling how much physical RAM the directory server uses.

This is not the entry cache. This is the amount of memory the Berkeley database back end will use to cache the indexes (the .db4 files) and other files. This value is passed to the Berkeley DB API function set_cachesize. If automatic cache resizing is activated, this attribute is overridden when the server replaces these values with its own guessed values at a later stage of the server startup.

For more technical information on this attribute, see the cache size section of the Berkeley DB reference guide at https://docs.oracle.com/cd/E17076_04/html/programmer_reference/general_am_conf.html#am_conf_cachesize.

Attempting to set a value that is not a number or is too big for a 32-bit signed integer returns an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

The server has to be restarted for changes to this attribute to go into effect.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	500 kilobytes to 4 gigabytes for 32-bit platforms and 500 kilobytes to 2^64-1 for 64-bit platforms
Default Value	10000000 (bytes)
Syntax	Integer
Example	nsslapd-dbcachesize: 10000000

4.4.1.4. nsslapd-db-checkpoint-interval

This sets the amount of time in seconds after which the Directory Server sends a checkpoint entry to the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. A checkpoint entry indicates which database operations have been physically written to the directory database. The checkpoint entries are used to determine where in the database transaction log to begin recovery after a system failure. The nsslapd-db-checkpoint-interval attribute is absent from dse.ldif. To change the checkpoint interval, add the attribute to dse.ldif. This attribute can be dynamically modified using ldapmodify. For further information on modifying this attribute, see the "Tuning Directory Server Performance" chapter in the Directory Server Administrator's Guide.

This attribute is provided only for system modification/diagnostics and should be changed only with the guidance of Red Hat technical support or Red Hat professional services. Inconsistent settings of this attribute and other configuration attributes may cause the Directory Server to be unstable.

For more information on database transaction logging, refer to the "Monitoring Server and Database Activity" chapter in the Directory Server Administrator's Guide.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	10 to 300 seconds
Default Value	60
Syntax	Integer
Example	nsslapd-db-checkpoint-interval: 120

4.4.1.5. nsslapd-db-circular-logging

This attribute specifies circular logging for the transaction log files. If this attribute is switched off, old transaction log files are not removed and are kept renamed as old log transaction files. Turning circular logging off can severely degrade server performance and, as such, should only be modified with the guidance of Red Hat Technical Support or Red Hat Professional Services.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	on \| off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-db-circular-logging: on

4.4.1.6. nsslapd-db-debug

This attribute specifies whether additional error information is to be reported to Directory Server. To report error information, set the parameter to on. This parameter is meant for troubleshooting; enabling the parameter may slow down the Directory Server.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	on \| off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-db-debug: off

4.4.1.7. nsslapd-db-durable-transactions

This attribute sets whether database transaction log entries are immediately written to the disk. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. With durable transactions enabled, every directory change will always be physically recorded in the log file and, therefore, able to be recovered in the event of a system failure. However, the durable transactions feature may also slow the performance of the Directory Server. When durable transactions is disabled, all transactions are logically written to the database transaction log but may not be physically written to disk immediately. If there were a system failure before a directory change was physically written to disk, that change would not be recoverable. The nsslapd-db-durable-transactions attribute is absent from dse.ldif. To disable durable transactions, add the attribute to dse.ldif.

This attribute is provided only for system modification/diagnostics and should be changed only with the guidance of Red Hat Technical Support or Red Hat Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause the Directory Server to be unstable.

For more information on database transaction logging, refer to the "Monitoring Server and Database Activity" chapter in the Directory Server Administrator's Guide.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	on \| off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-db-durable-transactions: on

4.4.1.8. nsslapd-db-home-directory

To move the database to another physical location for performance reasons, use this parameter to specify the home directory.

This situation will occur only for certain combinations of the database cache size, the size of physical memory, and kernel tuning attributes. In particular, this situation should not occur if the database cache size is less than 100 megabytes.

The disk is heavily used (more than 1 megabyte per second of data transfer).
There is a long service time (more than 100ms).
There is mostly write activity.

If these are all true, use the nsslapd-db-home-directory attribute to specify a subdirectory of a tempfs type filesystem.

The directory referenced by the nsslapd-db-home-directory attribute must be a subdirectory of a filesystem of type tempfs (such as /tmp). However, Directory Server does not create the subdirectory referenced by this attribute. This directory must be created either manually or by using a script. Failure to create the directory referenced by the nsslapd-db-home-directory attribute will result in Directory Server being unable to start.

Also, if there are multiple Directory Servers on the same machine, their nsslapd-db-home-directory attributes must be configured with different directories. Failure to do so will result in the databases for both directories becoming corrupted.

The use of this attribute causes internal Directory Server database files to be moved to the directory referenced by the attribute. It is possible, but unlikely, that the server will no longer start after the files have been moved because not enough memory can be allocated. This is a symptom of an overly large database cache size being configured for the server. If this happens, reduce the size of the database cache size to a value where the server will start again.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid directory name in a tempfs filesystem, such as `/tmp`
Default Value
Syntax	DirectoryString
Example	nsslapd-db-home-directory: /tmp/slapd-phonebook

4.4.1.9. nsslapd-db-idl-divisor

This attribute specifies the index block size in terms of the number of blocks per database page. The block size is calculated by dividing the database page size by the value of this attribute. A value of 1 makes the block size exactly equal to the page size. The default value of 0 sets the block size to the page size minus an estimated allowance for internal database overhead. For the majority of installations, the default value should not be changed unless there are specific tuning needs.

Before modifying the value of this attribute, export all databases using the db2ldif script. Once the modification has been made, reload the databases using the ldif2db script.

Warning

This parameter should only be used by very advanced users.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to 8
Default Value	0
Syntax	Integer
Example	nsslapd-db-idl-divisor: 2

4.4.1.10. nsslapd-db-logbuf-size

This attribute specifies the log information buffer size. Log information is stored in memory until the buffer fills up or the transaction commit forces the buffer to be written to disk. Larger buffer sizes can significantly increase throughput in the presence of long running transactions, highly concurrent applications, or transactions producing large amounts of data. The log information buffer size is the transaction log size divided by four.

The nsslapd-db-logbuf-size attribute is only valid if the nsslapd-db-durable-transactions attribute is set to on.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	32K to maximum 32-bit integer (limited to the amount of memory available on the machine)
Default Value	32K
Syntax	Integer
Example	nsslapd-db-logbuf-size: 32K

4.4.1.11. nsslapd-db-logdirectory

This attribute specifies the path and directory name of the directory containing the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. By default, the database transaction log is stored in the same directory as the directory entries themselves, /var/lib/dirsrv/slapd-instance_name/db. For fault-tolerance and performance reasons, move this log file to another physical disk. The nsslapd-db-logdirectory attribute is absent from dse.ldif. To change the location of the database transaction log, add the attribute to dse.ldif.

For more information on database transaction logging, refer to the "Monitoring Server and Database Activity" chapter in the Directory Server Administrator's Guide.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid path and directory name
Default Value
Syntax	DirectoryString
Example	nsslapd-db-logdirectory: /logs/txnlog

4.4.1.12. nsslapd-db-logfile-size

This attribute specifies the maximum size of a single file in the log in bytes. By default, or if the value is set to 0, a maximum size of 10 megabytes is used. The maximum size is an unsigned 4-byte value.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to unsigned 4-byte integer
Default Value	10MB
Syntax	Integer
Example	nsslapd-db-logfile-size: 10 MB

4.4.1.13. nsslapd-db-page-size

This attribute specifies the size of the pages used to hold items in the database in bytes. The minimum size is 512 bytes, and the maximum size is 64 kilobytes. If the page size is not explicitly set, Directory Server defaults to a page size of 8 kilobytes. Changing this default value can have a significant performance impact. If the page size is too small, it results in extensive page splitting and copying, whereas if the page size is too large it can waste disk space.

Before modifying the value of this attribute, export all databases using the db2ldif script. Once the modification has been made, reload the databases using the ldif2db script.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	512 bytes to 64 kilobytes
Default Value	8KB
Syntax	Integer
Example	nsslapd-db-page-size: 8KB

4.4.1.14. nsslapd-db-spin-count

This attribute specifies the number of times that test-and-set mutexes should spin without blocking.

Warning

Never touch this value unless you are very familiar with the inner workings of Berkeley DB or are specifically told to do so by Red Hat support.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to 2^31-1
Default Value	0
Syntax	Integer
Example	nsslapd-db-spin-count: 0

4.4.1.15. nsslapd-db-transaction-batch-val

This attribute specifies how many transactions will be batched before being committed. This attribute can improve update performance when full transaction durability is not required. This attribute can be dynamically modified using ldapmodify. For further information on modifying this attribute, refer to the "Tuning Directory Server Performance" chapter in the Directory Server Administrator's Guide.

Warning

Setting this value will reduce data consistency and may lead to loss of data. This is because if there is a power outage before the server can flush the batched transactions, those transactions in the batch will be lost.

Do not set this value unless specifically requested to do so by Red Hat support.

If this attribute is not defined or is set to a value of 0, transaction batching will be turned off, and it will be impossible to make remote modifications to this attribute via LDAP. However, setting this attribute to a value greater than 0 causes the server to delay committing transactions until the number of queued transactions is equal to the attribute value. A value greater than 0 also allows modifications to this attribute remotely via LDAP. A value of 1 for this attribute allows modifications to the attribute setting remotely via LDAP, but results in no batching behavior. A value of 1 at server startup is therefore useful for maintaining normal durability while also allowing transaction batching to be turned on and off remotely when desired. Remember that the value for this attribute may require modifying the nsslapd-db-logbuf-size attribute to ensure sufficient log buffer size for accommodating the batched transactions.

Note

The nsslapd-db-transaction-batch-val attribute is only valid if the nsslapd-db-durable-transaction attribute is set to on.

For more information on database transaction logging, refer to the "Monitoring Server and Database Activity" chapter in the Directory Server Administrator's Guide.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to 30
Default Value	0 (or turned off)
Syntax	Integer
Example	nsslapd-db-transaction-batch-val: 5

4.4.1.16. nsslapd-db-trickle-percentage

This attribute sets that at least the specified percentage of pages in the shared-memory pool are clean by writing dirty pages to their backing files. This is to ensure that a page is always available for reading in new information without having to wait for a write.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to 100
Default Value	40
Syntax	Integer
Example	nsslapd-db-trickle-percentage: 40

4.4.1.17. nsslapd-db-verbose

This attribute specifies whether to record additional informational and debugging messages when searching the log for checkpoints, doing deadlock detection, and performing recovery. This parameter is meant for troubleshooting, and enabling the parameter may slow down the Directory Server.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	on \| off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-db-verbose: off

4.4.1.18. nsslapd-dbncache

This attribute can split the LDBM cache into equally sized separate pieces of memory. It is possible to specify caches that are large enough so that they cannot be allocated contiguously on some architectures; for example, some systems limit the amount of memory that may be allocated contiguously by a process. If nsslapd-dbncache is 0 or 1, the cache will be allocated contiguously in memory. If it is greater than 1, the cache will be broken up into ncache, equally sized separate pieces of memory.

To configure a dbcache size larger than 4 gigabytes, add the nsslapd-dbncache attribute to cn=config,cn=ldbm database,cn=plugins,cn=config between the nsslapd-dbcachesize and nsslapd-db-logdirectory attribute lines.

Set this value to an integer that is one-quarter (1/4) the amount of memory in gigabytes. For example, for a 12 gigabyte system, set the nsslapd-dbncache value to 3; for an 8 gigabyte system, set it to 2.

The server has to be restarted for changes to this attribute to go into effect.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	1 to 4
Default Value	1
Syntax	Integer
Example	nsslapd-dbncache: 1

4.4.1.19. nsslapd-directory

This attribute specifies absolute path to database instance. If the database instance is manually created then this attribute must be included, something which is set by default (and modifiable) in the Directory Server Console. Once the database instance is created, do not modify this path as any changes risk preventing the server from accessing data.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid absolute path to the database instance
Default Value
Syntax	DirectoryString
Example	nsslapd-directory: /var/lib/dirsrv/slapd-instance_name/db

4.4.1.20. nsslapd-exclude-from-export

This attribute contains a space-separated list of names of attributes to exclude from an entry when a database is exported. This mainly is used for some configuration and operational attributes which are specific to a server instance.

Do not remove any of the default values for this attribute, since that may affect server performance.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid attribute
Default Value	entrydn entryid dncomp parentid numSubordinates entryusn
Syntax	DirectoryString
Example	nsslapd-exclude-from-export: entrydn entryid dncomp parentid numSubordinates entryusn

4.4.1.21. nsslapd-idlistscanlimit

This performance-related attribute, present by default, specifies the number of entry IDs that are searched during a search operation. Attempting to set a value that is not a number or is too big for a 32-bit signed integer returns an LDAP_UNWILLING_TO_PERFORM error message, with additional error information explaining the problem. It is advisable to keep the default value to improve search performance.

For further details, see the corresponding sections in the:

This parameter can be changed while the server is running, and the new value will affect subsequent searches.

The corresponding user-level attribute is nsIDListScanLimit.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	100 to the maximum 32-bit integer value (2147483647) entry IDs
Default Value	4000
Syntax	Integer
Example	nsslapd-idlistscanlimit: 4000

4.4.1.22. nsslapd-import-cache-autosize

This performance tuning-related attribute automatically sets the size of the import cache (importCache) to be used during the command-line-based import process of LDIF files to the database (the ldif2db operation).

In Directory Server, the import operation can be run as a server task or exclusively on the command-line. In the task mode, the import operation runs as a general Directory Server operation. The nsslapd-import-cache-autosize attribute enables the import cache to be set automatically to a predetermined size when the import operation is run on the command-line. The attribute can also be used by Directory Server during the task mode import for allocating a specified percentage of free memory for import cache.

By default, the nsslapd-import-cache-autosize attribute is enabled and is set to a value of -1. This value autosizes the import cache for the ldif2db operation only, automatically allocating fifty percent (50%) of the free physical memory for the import cache. The percentage value (50%) is hard-coded and cannot be changed.

Setting the attribute value to 50 (nsslapd-import-cache-autosize: 50) has the same effect on performance during an ldif2db operation. However, such a setting will have the same effect on performance when the import operation is run as a Directory Server task. The -1 value autosizes the import cache just for the ldif2db operation and not for any, including import, general Directory Server tasks.

Note

The purpose of a -1 setting is to enable the ldif2db operation to benefit from free physical memory but, at the same time, not compete for valuable memory with the entry cache, which is used for general operations of the Directory Server.

Setting the nsslapd-import-cache-autosize attribute value to 0 turns off the import cache autosizing feature - that is, no autosizing occurs during either mode of the import operation. Instead, Directory Server uses the nsslapd-import-cachesize attribute for import cache size, with a default value of 20000000.

There are three caches in the context of Directory Server: database cache, entry cache, and import cache. The import cache is only used during the import operation. The nsslapd-cache-autosize attribute, which is used for autosizing the entry cache and database cache, is used during the Directory Server operations only and not during the ldif2db command-line operation; the attribute value is the percentage of free physical memory to be allocated for the entry cache and database cache.

If both the autosizing attributes, nsslapd-cache-autosize and nsslapd-import-cache-autosize, are enabled, ensure that their sum is less than 100.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	-1, 0 (turns import cache autosizing off) to 100
Default Value	-1 (turns import cache autosizing on for ldif2db only and allocates 50% of the free physical memory to import cache)
Syntax	Integer
Example	nsslapd-import-cache-autosize: -1

4.4.1.23. nsslapd-import-cachesize

This performance tuning-related attribute determines the size, in bytes, of the database cache used in the bulk import process. Setting this attribute value so that the maximum available system physical memory is used for the database cache during bulk importing optimizes bulk import speed. Attempting to set a value that is not a number or is too big for a 32-bit signed integer returns an LDAP_UNWILLING_TO_PERFORM error message, with additional error information explaining the problem.

Note

A cache is created for each load that occurs. For example, if the user sets the nsslapd-import-cachesize attribute to 1 gigabyte, then 1 gigabyte is used when loading one database, 2 gigabytes is used when loading two databases, and so on. Ensure there is sufficient physical memory to prevent swapping from occurring, as this would result in performance degradation.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	500 kilobytes to 4 gigabytes for 32-bit platforms and 500 kilobytes to 2^64-1 for 64-bit platforms
Default Value	20000000
Syntax	Integer
Example	nsslapd-import-cachesize: 20000000

4.4.1.24. nsslapd-lookthroughlimit

This performance-related attribute specifies the maximum number of entries that the Directory Server will check when examining candidate entries in response to a search request. The Directory Manager DN, however, is, by default, unlimited and overrides any other settings specified here. It is worth noting that binder-based resource limits work for this limit, which means that if a value for the operational attribute nsLookThroughLimit is present in the entry as which a user binds, the default limit will be overridden. Attempting to set a value that is not a number or is too big for a 32-bit signed integer returns an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	-1 to maximum 32-bit integer in entries (where -1 is unlimited)
Default Value	5000
Syntax	Integer
Example	nsslapd-lookthroughlimit: 5000

4.4.1.25. nsslapd-mode

This attribute specifies the permissions used for newly created index files.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any four-digit octal number. However, mode `0600` is recommended. This allows read and write access for the owner of the index files (which is the user as whom the `ns-slapd` runs) and no access for other users.
Default Value	600
Syntax	Integer
Example	nsslapd-mode: 0600

4.4.1.26. nsslapd-pagedidlistscanlimit

This performance-related attribute specifies the number of entry IDs that are searched, specifically, for a search operation using the simple paged results control.

This attribute works the same as the nsslapd-idlistscanlimit attribute, except that it only applies to searches with the simple paged results control.

If this attribute is not present or is set to zero, then the nsslapd-idlistscanlimit is used to paged searches as well as non-paged searches.

The corresponding user-level attribute is nsPagedIDListScanLimit.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	-1 to maximum 32-bit integer in entries (where -1 is unlimited)
Default Value	0
Syntax	Integer
Example	nsslapd-pagedidlistscanlimit: 5000

4.4.1.27. nsslapd-pagedlookthroughlimit

This performance-related attribute specifies the maximum number of entries that the Directory Server will check when examining candidate entries for a search which uses the simple paged results control.

This attribute works the same as the nsslapd-lookthroughlimit attribute, except that it only applies to searches with the simple paged results control.

If this attribute is not present or is set to zero, then the nsslapd-lookthroughlimit is used to paged searches as well as non-paged searches.

The corresponding user-level attribute is nsPagedLookThroughLimit.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	-1 to maximum 32-bit integer in entries (where -1 is unlimited)
Default Value	0
Syntax	Integer
Example	nsslapd-pagedlookthroughlimit: 25000

4.4.1.28. nsslapd-rangelookthroughlimit

This performance-related attribute specifies the maximum number of entries that the Directory Server will check when examining candidate entries in response to a range search request.

Range searches use operators to set a bracket to search for and return an entire subset of entries within the directory. For example, this searches for every entry modified at or after midnight on January 1:

(modifyTimestamp>=20170101010101Z)

The nature of a range search is that it must evaluate every single entry within the directory to see if it is within the range given. Essentially, a range search is always an all IDs search.

For most users, the look-through limit kicks in and prevents range searches from turning into an all IDs search. This improves overall performance and speeds up range search results. However, some clients or administrative users like Directory Manager may not have a look-through limit set. In that case, a range search can take several minutes to complete or even continue indefinitely.

The nsslapd-rangelookthroughlimit attribute sets a separate range look-through limit that applies to all users, including Directory Manager.

This allows clients and administrative users to have high look-through limits while still allowing a reasonable limit to be set on potentially performance-impaired range searches.

Note

Unlike other resource limits, this applies to searches by any user, including the Directory Manager, regular users, and other LDAP clients.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	-1 to maximum 32-bit integer in entries (where -1 is unlimited)
Default Value	5000
Syntax	Integer
Example	nsslapd-rangelookthroughlimit: 5000

4.4.1.29. nsslapd-subtree-rename-switch

Every directory entry is stored as a key in an entry index file. The index key maps the current entry DN to its meta entry in the index. This mapping is done either by the RDN of the entry or by the full DN of the entry.

When a subtree entry is allowed to be renamed (meaning, an entry with children entries, effectively renaming the whole subtree), its entries are stored in the entryrdn.db4 index, which associates parent and child entries by an assigned ID rather than their DN. If subtree rename operations are not allowed, then the entryrdn.db4 index is disabled and the entrydn.db4 index is used, which simply uses full DNs, with the implicit parent-child relationships.

Parameter	Description
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	off \| on
Default Value	on
Syntax	DirectoryString
Example	nsslapd-subtree-rename-switch: on

4.4.2. Database Attributes under cn=monitor,cn=ldbm database,cn=plugins,cn=config

Global read-only attributes containing database statistics for monitoring activity on the databases are stored in the cn=monitor,cn=ldbm database,cn=plugins,cn=config tree node. For more information on these entries, refer to the "Monitoring Server and Database Activity" chapter in the Directory Server Administrator's Guide.

dbcachehits

This attribute shows the requested pages found in the database.

dbcachetries

This attribute shows the total cache lookups.

dbcachehitratio

This attribute shows the percentage of requested pages found in the database cache (hits/tries).

dbcachepagein

This attribute shows the pages read into the database cache.

dbcachepageout

This attribute shows the pages written from the database cache to the backing file.

dbcacheroevict

This attribute shows the clean pages forced from the cache.

dbcacherwevict

This attribute shows the dirty pages forced from the cache.

Important

The Directory Server database uses the unsigned 32-bit integer data type for internal values that are used to calculate dbcachehits, dbcachetries, and dbcachehitratio. When a directory instance runs for a long time, the values can reach the maximum of 4294967295 and overflow.

4.4.3. Database Attributes under cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config and cn=userRoot,cn=ldbm database,cn=plugins,cn=config

The cn=NetscapeRoot and cn=userRoot subtrees contain configuration data for, or the definition of, the databases containing the o=NetscapeRoot and o=userRoot suffixes. The cn=NetscapeRoot subtree contains the configuration data used by the Admin Server for authentication and all actions that cannot be performed through LDAP (such as start/stop), and the cn=userRoot subtree contains all the configuration data for the user-defined database.

The cn=userRoot subtree is called userRoot by default. However, this is not hard-coded and, given the fact that there are going to be multiple database instances, this name is changed and defined by the user as and when new databases are added. The cn=userRoot database referenced can be any user database.

The following attributes are common to both the cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config and the user database, such as cn=userRoot or cn=database_name,cn=ldbm database,cn=plugins,cn=config subtrees.

4.4.3.1. nsslapd-cachesize

This attribute has been deprecated. To resize the entry cache, use nsslapd-cachememsize.

This performance tuning-related attribute specifies the cache size in terms of the number of entries it can hold. However, this attribute is deprecated in favor of the nsslapd-cachememsize attribute, which sets an absolute allocation of RAM for the entry cache size, as described in Section 4.4.3.2, “nsslapd-cachememsize”.

Note

The nsslapd-cachememsize attribute also defines the import buffer size. The import buffer size is automatically configured to be 80% of whatever the nsslapd-cachememsize setting is. When importing databases with very large attributes, be sure to reset the nsslapd-cachememsize value to something high enough so that .80*cacheSize is enough to allow the import to proceed.

Attempting to set a value that is not a number or is too big for a 32-bit signed integer (on 32-bit systems) returns an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

The server has to be restarted for changes to this attribute to go into effect.

Note

The performance counter for this setting goes to the highest 64-bit integer, even on 32-bit systems, but the setting itself is limited on 32-bit systems to the highest 32-bit integer because of how the system addresses memory.

Parameter	Description
Entry DN	cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Range	1 to 2³²-1 on 32-bit systems or 2⁶³-1 on 64-bit systems or -1, which means limitless
Default Value	-1
Syntax	Integer
Example	nsslapd-cachesize: -1

4.4.3.2. nsslapd-cachememsize

This performance tuning-related attribute specifies the size, in bytes, for the available memory space for the entry cache. The simplest method is limiting cache size in terms of memory occupied. Activating automatic cache resizing overrides this attribute, replacing these values with its own guessed values at a later stage of the server startup.

Note

Parameter	Description
Entry DN	cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Range	500 kilobytes to 2³²-1 on 32-bit systems and to 2⁶⁴-1 on 64-bit systems
Default Value	10,485,760 (10 megabytes)
Syntax	Integer
Example	nsslapd-cachememsize: 10485760

4.4.3.3. nsslapd-directory

This attribute specifies the path to the database instance. If it is a relative path, it starts from the path specified by nsslapd-directory in the global database entry cn=config,cn=ldbm database,cn=plugins,cn=config. The database instance directory is named after the instance name and located in the global database directory, by default. After the database instance has been created, do not modify this path, because any changes risk preventing the server from accessing data.

Parameter	Description
Entry DN	cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid path to the database instance
Default Value
Syntax	DirectoryString
Example	nsslapd-directory: /var/lib/dirsrv/slapd-instance_name/db/userRoot

4.4.3.4. nsslapd-dncachememsize

This performance tuning-related attribute specifies the size, in bytes, for the available memory space for the DN cache. The DN cache is similar to the entry cache for a database, only its table stores only the enrty ID and the entry DN. This allows faster lookups for rename and moddn operations.

The simplest method is limiting cache size in terms of memory occupied.

Note

Parameter	Description
Entry DN	cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Range	500 kilobytes to 2³²-1 on 32-bit systems and to 2⁶⁴-1 on 64-bit systems
Default Value	10,485,760 (10 megabytes)
Syntax	Integer
Example	nsslapd-dncachememsize: 10485760

4.4.3.5. nsslapd-readonly

This attribute specifies read-only mode for a single back-end instance. If this attribute has a value of off, then users have all read, write, and execute permissions allowed by their access permissions.

Parameter	Description
Entry DN	cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	on \| off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-readonly: off

4.4.3.6. nsslapd-require-index

When switched to on, this attribute allows one to refuse unindexed searches. This performance-related attribute avoids saturating the server with erroneous searches.

Parameter	Description
Entry DN	cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	on \| off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-require-index: off

4.4.3.7. nsslapd-suffix

This attribute specifies the suffix of the database link. This is a single-valued attribute because each database instance can have only one suffix. Previously, it was possible to have more than one suffix on a single database instance, but this is no longer the case. As a result, this attribute is single-valued to enforce the fact that each database instance can only have one suffix entry. Any changes made to this attribute after the entry has been created take effect only after the server containing the database link is restarted.

Parameter	Description
Entry DN	cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid DN
Default Value
Syntax	DirectoryString
Example	nsslapd-suffix: o=NetscapeRoot

4.4.3.8. vlvBase

This attribute sets the base DN for which the browsing or virtual list view (VLV) index is created.

For more information on VLV indexes, see the indexing chapter in the Administrator's Guide.

Note

This attribute is only available to user databases like userRoot, not configuration databases like o=NetscapeRoot.

Parameter	Description
Entry DN	cn=index_name,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid DN
Default Value
Syntax	DirectoryString
Example	vlvBase: ou=People,dc=example,dc=com

4.4.3.9. vlvEnabled

This attribute sets whether the browsing or virtual list view (VLV) index is enabled.

For more information on VLV indexes, see the indexing chapter in the Administrator's Guide.

Note

This attribute is only available to user databases like userRoot, not configuration databases like o=NetscapeRoot.

Parameter	Description
Entry DN	cn=index_name,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
Valid Values	0 (disabled) \| 1 (enabled)
Default Value	1
Syntax	DirectoryString
Example	vlvEnbled: 0

4.4.3.10. vlvFilter

The browsing or virtual list view (VLV) index is created by running a search according to a filter and including entries which match that filter in the index. The filter is specified in the vlvFilter attribute.

For more information on VLV indexes, see the indexing chapter in the Administrator's Guide.

Note

This attribute is only available to user databases like userRoot, not configuration databases like o=NetscapeRoot.

Parameter	Description
Entry DN	cn=index_name,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid LDAP filter
Default Value
Syntax	DirectoryString
Example	vlvFilter: (\|(objectclass=*)(objectclass=ldapsubentry))

4.4.3.11. vlvIndex (Object Class)

A browsing index or virtual list view (VLV) index dynamically generates an abbreviated index of entry headers that makes it much faster to visually browse large indexes. A VLV index definition has two parts: one which defines the index and one which defines the search used to identify entries to add to the index. The vlvIndex object class defines the index entry.

This object class is defined in Directory Server.

Superior Class

top

OID

2.16.840.1.113730.3.2.42

Required Attributes

Attribute	Definition
objectClass	Defines the object classes for the entry.
cn	Gives the common name of the entry.
vlvSort	Identifies the attribute list that the browsing index (virtual list view index) is sorted on.

Allowed Attributes

Attribute	Definition
vlvEnabled	Stores the availability of the browsing index.
vlvUses	Contains the count the browsing index is used.

4.4.3.12. vlvScope

This attribute sets the scope of the search to run for entries in the browsing or virtual list view (VLV) index.

For more information on VLV indexes, see the indexing chapter in the Administrator's Guide.

Note

This attribute is only available to user databases like userRoot, not configuration databases like o=NetscapeRoot.

Parameter

Description

Entry DN

cn=index_name,cn=userRoot,cn=ldbm database,cn=plugins,cn=config

Valid Values

1 (one-level or children search)

2 (subtree search)

Default Value

Syntax

Integer

Example

vlvScope: 2

4.4.3.13. vlvSearch (Object Class)

This object class is defined in Directory Server.

Superior Class

top

OID

2.16.840.1.113730.3.2.38

Required Attributes

Attribute	Definition
objectClass	Defines the object classes for the entry.
vlvBase	Identifies base DN the browsing index is created.
vlvScope	Identifies the scope to define the browsing index.
vlvFilter	Identifies the filter string to define the browsing index.

Allowed Attributes

Attribute	Definition
multiLineDescription	Gives a text description of the entry.

4.4.3.14. vlvSort

This attribute sets the sort order for returned entries in the browsing or virtual list view (VLV) index.

Note

The entry for this attribute is a vlvIndex entry beneath the vlvSearch entry.

For more information on VLV indexes, see the indexing chapter in the Administrator's Guide.

Note

This attribute is only available to user databases like userRoot, not configuration databases like o=NetscapeRoot.

Parameter	Description
Entry DN	cn=index_name,cn=index_name,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any Directory Server attributes, in a space-separated list
Default Value
Syntax	DirectoryString
Example	vlvSort: cn givenName o ou sn

4.4.3.15. vlvUses

This attribute contains the count for the browsing or virtual list view (VLV) index.

For more information on VLV indexes, see the indexing chapter in the Administrator's Guide.

Note

This attribute is only available to user databases like userRoot, not configuration databases like o=NetscapeRoot.

Parameter	Description
Entry DN	cn=index_name,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
Valid Values	N/A
Default Value
Syntax	DirectoryString
Example	vlvUses: 800

4.4.4. Database Attributes under cn=monitor,cn=userRoot,cn=ldbm database,cn=plugins,cn=config

The attributes in this tree node entry are all read-only, database performance counters.

If the nsslapd-counters attribute in cn=config is set to on, then some of the counters kept by the Directory Server instance increment using 64-bit integers, even on 32-bit machines or with a 32-bit version of Directory Server. For database monitoring, the entrycachehits and entrycachetries counters use 64-bit integers.

Note

The nsslapd-counters attribute enables 64-bit support for these specific database and server counters. The counters which use 64-bit integers are not configurable; the 64-bit integers are either enabled for all the allowed counters or disabled for all allowed counters.

currentNormalizedDNcachecount

Number of normalized cached DNs.

currentNormalizedDNcachesize

Current size of the normalized DN cache in bytes.

normalizedDNcachehitratio

Percentage of the normalized DNs found in the cache.

normalizedDNcachehits

Normalized DNs found within the cache.

normalizedDNcachemisses

Normalized DNs not found within the cache.

normalizedDNcachetries

Total number of cache lookups since the instance was started.

maxNormalizedDNcachesize

Current value of the nsslapd-ndn-cache-max-size parameter. For details how to update this setting, see Section 3.1.1.100, “nsslapd-ndn-cache-max-size”.

4.4.5. Database Attributes under cn=monitor,cn=database,cn=ldbm database,cn=plugins,cn=config

The attributes in this tree node entry are all read-only, database performance counters. All of the values for these attributes are 32-bit integers, except for entrycachehits and entrycachetries.

If the nsslapd-counters attribute in cn=config is set to on, then some of the counters kept by the Directory Server instance increment using 64-bit integers, even on 32-bit machines or with a 32-bit version of Directory Server. For the database monitoring, the entrycachehits and entrycachetries counters use 64-bit integers.

Note

nsslapd-db-abort-rate

This attribute shows the number of transactions that have been aborted.

nsslapd-db-active-txns

This attribute shows the number of transactions that are currently active.

nsslapd-db-cache-hit

This attribute shows the requested pages found in the cache.

nsslapd-db-cache-try

This attribute shows the total cache lookups.

nsslapd-db-cache-region-wait-rate

This attribute shows the number of times that a thread of control was forced to wait before obtaining the region lock.

nsslapd-db-cache-size-bytes

This attribute shows the total cache size in bytes.

nsslapd-db-clean-pages

This attribute shows the clean pages currently in the cache.

nsslapd-db-commit-rate

This attribute shows the number of transactions that have been committed.

nsslapd-db-deadlock-rate

This attribute shows the number of deadlocks detected.

nsslapd-db-dirty-pages

This attribute shows the dirty pages currently in the cache.

nsslapd-db-hash-buckets

This attribute shows the number of hash buckets in buffer hash table.

nsslapd-db-hash-elements-examine-rate

This attribute shows the total number of hash elements traversed during hash table lookups.

nsslapd-db-hash-search-rate

This attribute shows the total number of buffer hash table lookups.

nsslapd-db-lock-conflicts

This attribute shows the total number of locks not immediately available due to conflicts.

nsslapd-db-lock-region-wait-rate

This attribute shows the number of times that a thread of control was forced to wait before obtaining the region lock.

nsslapd-db-lock-request-rate

This attribute shows the total number of locks requested.

nsslapd-db-lockers

This attribute shows the number of current lockers.

nsslapd-db-log-bytes-since-checkpoint

This attribute shows the number of bytes written to this log since the last checkpoint.

nsslapd-db-log-region-wait-rate

This attribute shows the number of times that a thread of control was forced to wait before obtaining the region lock.

nsslapd-db-log-write-rate

This attribute shows the number of megabytes and bytes written to this log.

nsslapd-db-longest-chain-length

This attribute shows the longest chain ever encountered in buffer hash table lookups.

nsslapd-db-page-create-rate

This attribute shows the pages created in the cache.

nsslapd-db-page-read-rate

This attribute shows the pages read into the cache.

nsslapd-db-page-ro-evict-rate

This attribute shows the clean pages forced from the cache.

nsslapd-db-page-rw-evict-rate

This attribute shows the dirty pages forced from the cache.

nsslapd-db-page-trickle-rate

This attribute shows the dirty pages written using the memp_trickle interface.

nsslapd-db-page-write-rate

This attribute shows the pages read into the cache.

nsslapd-db-pages-in-use

This attribute shows all pages, clean or dirty, currently in use.

nsslapd-db-txn-region-wait-rate

This attribute shows the number of times that a thread of control was force to wait before obtaining the region lock.

currentdncachecount

This attribute shows the number of DNs currently present in the DN cache.

currentdncachesize

This attribute shows the total size, in bytes, of DNs currently present in the DN cache.

maxdncachesize

This attribute shows the maximum size, in bytes, of DNs that can be maintained in the database DN cache.

4.4.6. Database Attributes under cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config

The set of default indexes is stored here. Default indexes are configured per back end in order to optimize Directory Server functionality for the majority of setup scenarios. All indexes, except system-essential ones, can be removed, but care should be taken so as not to cause unnecessary disruptions. For further information on indexes, refer to the "Managing Indexes" chapter in the Directory Server Administrator's Guide.

4.4.6.1. cn

This attribute provides the name of the attribute to index.

Parameter	Description
Entry DN	cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid index cn
Default Value	None
Syntax	DirectoryString
Example	cn: aci

4.4.6.2. nsIndex

This object class defines an index in the back end database. This object is defined in Directory Server.

Superior Class

top

OID

2.16.840.1.113730.3.2.44

Required Attributes

Attribute	Definition
objectClass	Defines the object classes for the entry.
cn	Gives the common name of the entry.
nsSystemIndex	Identify whether or not the index is a system defined index.

Allowed Attributes

Attribute	Definition
description	Gives a text description of the entry.
nsIndexType	Identifies the index type.
nsMatchingRule	Identifies the matching rule.

4.4.6.3. nsIndexType

This optional, multi-valued attribute specifies the type of index for Directory Server operations and takes the values of the attributes to be indexed. Each desired index type has to be entered on a separate line.

Parameter	Description
Entry DN	cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	pres = presence index eq = equality index approx = approximate index sub = substring index matching rule = international index index browse = browsing index
Default Value
Syntax	DirectoryString
Example	nsIndexType: eq

4.4.6.4. nsMatchingRule

This optional, multi-valued attribute specifies the ordering matching rule name or OID used to match values and to generate index keys for the attribute. This is most commonly used to ensure that equality and range searches work correctly for languages other than English (7-bit ASCII).

This is also used to allow range searches to work correctly for integer syntax attributes that do not specify an ordering matching rule in their schema definition. uidNumber and gidNumber are two commonly used attributes that fall into this category.

For example, for a uidNumber that uses integer syntax, the rule attribute could be nsMatchingRule: integerOrderingMatch.

Note

Any change to this attribute will not take effect until the change is saved and the index is rebuilt using db2index, which is described in more detail in the "Managing Indexes" chapter of the Directory Server Administrator's Guide).

Parameter	Description
Entry DN	cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any valid collation order object identifier (OID)
Default Value	None
Syntax	DirectoryString
Example	nsMatchingRule: 2.16.840.1.113730.3.3.2.3.1 (For Bulgarian)

4.4.6.5. nsSystemIndex

This mandatory attribute specifies whether the index is a system index, an index which is vital for Directory Server operations. If this attribute has a value of true, then it is system-essential. System indexes should not be removed, as this will seriously disrupt server functionality.

Parameter	Description
Entry DN	cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Values	true \| false
Default Value
Syntax	DirectoryString
Example	nssystemindex: true

4.4.7. Database Attributes under cn=monitor,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config

This section covers global, read-only entries for monitoring activity on the NetscapeRoot database. The attributes containing database statistics are given for each file that makes up the database. For further information, see the "Monitoring Server and Database Activity" chapter in the Directory Server Administrator's Guide.

dbfilenamenumber

This attribute gives the name of the file and provides a sequential integer identifier (starting at 0) for the file. All associated statistics for the file are given this same numerical identifier.

dbfilecachehit

This attribute gives the number of times that a search requiring data from this file was performed and that the data were successfully obtained from the cache.

dbfilecachemiss

This attribute gives the number of times that a search requiring data from this file was performed and that the data could not be obtained from the cache.

dbfilepagein

This attribute gives the number of pages brought to the cache from this file.

dbfilepageout

This attribute gives the number of pages for this file written from cache to disk.

4.4.8. Database Attributes under cn=index,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config and cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config

In addition to the set of default indexes that are stored under cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config, custom indexes can be created for o=NetscapeRoot, o=UserRoot, and user-defined back end instances; these are stored under cn=index, cn=database_name, cn=ldbm database,cn=plugins,cn=config. Each indexed attribute represents a subentry under the cn=config information tree nodes, as shown in the following diagram:

Figure 4.2. Indexed Attribute Representing a Subentry

For example, the index file for the aci attribute under o=UserRoot appears in the Directory Server as follows:

dn:cn=aci,cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config
objectclass:top
objectclass:nsIndex
cn:aci
nsSystemIndex:true
nsIndexType:pres

These entries share all of the indexing attributes listed for the default indexes in Section 4.4.6, “Database Attributes under cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config”. For further information about indexes, refer to the "Managing Indexes" chapter in the Directory Server Administrator's Guide.

4.4.8.1. nsIndexIDListScanLimit

This multi-valued parameter defines a search limit for certain indices or to use no ID list. For further information, see the corresponding section in the Directory Server Performance Tuning Guide.

Parameter	Description
Entry DN	cn=attribute_name,cn=index,cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	See the corresponding section in the Directory Server Performance Tuning Guide.
Default Value
Syntax	DirectoryString
Example	nsIndexIDListScanLimit: limit=0 type=eq values=inetorgperson

4.4.8.2. nsSubStrBegin

By default, for a search to be indexed, the search string must be at least three characters long, without counting any wildcard characters. For example, the string abc would be an indexed search while ab* would not be. Indexed searches are significantly faster than unindexed searches, so changing the minimum length of the search key is helpful to increase the number of indexed searches.

This substring length can be edited based on the position of any wildcard characters. The nsSubStrBegin attribute sets the required number of characters for an indexed search for the beginning of a search string, before the wildcard. For example:

abc*

If the value of this attribute is changed, then the index must be regenerated using db2index.

Parameter	Description
Entry DN	cn=attribute_name,cn=index,cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any integer
Default Value	3
Syntax	Integer
Example	nsSubStrBegin: 2

4.4.8.3. nsSubStrEnd

This substring length can be edited based on the position of any wildcard characters. The nsSubStrEnd attribute sets the required number of characters for an indexed search for the end of a search string, after the wildcard. For example:

*xyz

If the value of this attribute is changed, then the index must be regenerated using db2index.

Parameter	Description
Entry DN	cn=attribute_name,cn=index,cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any integer
Default Value	3
Syntax	Integer
Example	nsSubStrEnd: 2

4.4.8.4. nsSubStrMiddle

This substring length can be edited based on the position of any wildcard characters. The nsSubStrMiddle attribute sets the required number of characters for an indexed search where a wildcard is used in the middle of a search string. For example:

ab*z

If the value of this attribute is changed, then the index must be regenerated using db2index.

Parameter	Description
Entry DN	cn=attribute_name,cn=index,cn=database_name,cn=ldbm database,cn=plugins,cn=config
Valid Values	Any integer
Default Value	3
Syntax	Integer
Example	nsSubStrMiddle: 3

4.4.9. Database Attributes under cn=attributeName,cn=encrypted attributes,cn=database_name,cn=ldbm database,cn=plugins,cn=config

The nsAttributeEncryption object class allows selective encryption of attributes within a database. Extremely sensitive information such as credit card numbers and government identification numbers may not be protected enough by routine access control measures. Normally, these attribute values are stored in CLEAR within the database; encrypting them while they are stored adds another layer of protection. This object class has one attribute, nsEncryptionAlgorithm, which sets the encryption cipher used per attribute. Each encrypted attribute represents a subentry under the above cn=config information tree nodes, as shown in the following diagram:

Figure 4.3. Encrypted Attributes under the cn=config Node

For example, the database encryption file for the userPassword attribute under o=UserRoot appears in the Directory Server as follows:

dn:cn=userPassword,cn=encrypted attributes,o=UserRoot,cn=ldbm database,
cn=plugins,cn=config
objectclass:top
objectclass:nsAttributeEncryption
cn:userPassword
nsEncryptionAlgorithm:AES

To configure database encryption, see the "Database Encryption" section of the "Configuring Directory Databases" chapter in the Directory Server Administrator's Guide. For more information about indexes, refer to the "Managing Indexes" chapter in the Directory Server Administrator's Guide.

4.4.9.1. nsAttributeEncryption (Object Class)

This object class is used for core configuration entries which identify and encrypt selected attributes within a Directory Server database.

This object class is defined in Directory Server.

Superior Class

top

OID

2.16.840.1.113730.3.2.316

Required Attributes

objectClass	Defines the object classes for the entry.
cn	Specifies the attribute being encrypted using its common name.
nsEncryptionAlgorithm	The encryption cipher used.

4.4.9.2. nsEncryptionAlgorithm

nsEncryptionAlgorithm selects the cipher used by nsAttributeEncryption. The algorithm can be set per encrypted attribute.

Parameter	Description
Entry DN	cn=attributeName,cn=encrypted attributes,cn=databaseName,cn=ldbm database,cn=plugins,cn=config
Valid Values	The following are supported ciphers: Advanced Encryption Standard Block Cipher (AES) Triple Data Encryption Standard Block Cipher (3DES)
Default Value
Syntax	DirectoryString
Example	nsEncryptionAlgorithm: AES

Where did the comment section go?

Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.