Environment
NetIQ eDirectory 9.0
Situation
NOTE: This TID describes the behavior of system created indexes on eDirectory 9.0. eDirectory 9.1 reverts to our prior behavior where these indexes will be created automatically. Therefore, on eDirectory 9.1 nothing need be done.
9.0 Behavior:
In previous versions of eDirectory once an attribute's values reach a count of 25 on one object or 2048 bytes in size the values would be moved to their own attribute container and an index created automatically. This helps improves read and write performance. However, this process can take some time to complete if the eDirectory database is very large. During this time anyone searching on this database would receive the following error until the movement is completed:
Error:attribute maintenance in progress (-6029)
Resolution
To minimize disruption to production time eDirectory 9.0, by default, only marks those attributes that are to be moved. These attribute values can then be allowed to index during off-peak hours by manually starting the process. However, until the containerization of the values takes place, there will be a slight performance hit when searching on the attribute compared to after the index is created.
Additional Information
This is a three step process:
1. Determine if any attributes have been marked for indexing using iMonitor or ndscheck.
2. Gather the name(s) of the attribute(s) in iMonitor.
3. Run a single object repair on the Pseudo Server specifying the attribute waiting to be indexed.
There are two ways to check to see if any attributes have been marked: iMonitor and ndscheck.
1a. iMonitor - Agent Health:
Log into iMonitor and navigate to Agent Health - choosing Agent Health - Agent.
The screen below shows there is one attribute marked for deletion.
1b. ndscheck
The ndscheck provides additional information in eDirectory 9.0. Along with the EBA status information the number of attributes ready to be moved is also given as below:
2. The report indicates there is an attribute that qualifies for indexing. The next step is to find the name of the attribute. This list of attribute names can be found in the dsContainerReadyAttrs attribute of the Pseudo Server and is viewable in iMonitor.
Log into iMonitor then click on the Agent Configuration link found on the left frame. Towards the end of the Connection Information section in the middle of the screen the Pseudo Server's EID can be seen. In this case it is 8007. Click on it.
The Pseudo Server's attributes are now displayed. Click on the dsContainerReadyAttrs attribute link on the left then note the name of the attribute(s) displayed. In this example it is SAS:Vendor Support.
3. Run the ndsrepair command to kick off the indexing of this attribute's values. The syntax of the command is:
MONITORING
Monitoring of the process and its completion can be done performed with ndstrace using the +RECM flag.
MAKING THIS AUTOMATIC
To bring back the old behavior of immediately creating these indexes when the conditions are met add the following line to the _ndsdb.ini file and restart eDirectory:
NOTE: A new installation of eDirectory 9.0.2 or later will use automatic indexing.
1. Determine if any attributes have been marked for indexing using iMonitor or ndscheck.
2. Gather the name(s) of the attribute(s) in iMonitor.
3. Run a single object repair on the Pseudo Server specifying the attribute waiting to be indexed.
There are two ways to check to see if any attributes have been marked: iMonitor and ndscheck.
1a. iMonitor - Agent Health:
Log into iMonitor and navigate to Agent Health - choosing Agent Health - Agent.
The screen below shows there is one attribute marked for deletion.
1b. ndscheck
The ndscheck provides additional information in eDirectory 9.0. Along with the EBA status information the number of attributes ready to be moved is also given as below:
> ndscheck
Performing health check on the eDirectory server ".CN=90svr1.O=emg.T=HV9_TREE1." ...
--------------------------------------------------------------------------------------
Checking eDirectory LDAP and HTTP services...
Checking health of partitions ...
Status of partition ".T=HV9_TREE1." ...
Checking the status of the replica ring...
Number of replicas = 3
+---------------------------------+-------+-------------------------+---------------+------------------+
Server Name Status Time Sync Time Delta Replica State
+---------------------------------+-------+-------------------------+---------------+------------------+
.CN=90svr1.O=emg.T=HV9_TREE1. UP YES 0 m:0 s ON
.CN=90svr2.O=emg.T=HV9_TREE1. UP YES 0 m:4 s ON
.CN=HV2012-SVR1-NDS.O=emg.T=HV9... UP YES 1 m:11 s ON
+---------------------------------+-------+-------------------------+---------------+------------------+
Checking replication delta on the partition...
Maximum replica ring delta "0:10:47 (hh:mm:ss)"
Perishable delta on this server: "0:0:0 (hh:mm:ss)"
EBAHealthCheck:
Server is EBA enabled
EBA mechanisms:
* EBATLS
INFO: EBACA = true
INFO: NCPCA validity start = Mon Feb 1 17:12:05 2016
INFO: NCPCA validity end = Thu Jan 29 17:12:05 2026
INFO: CRL validity start = Fri Feb 5 15:32:04 2016
INFO: CRL validity end = Mon Feb 8 15:32:04 2016
INFO: EBACA certificate validity start = Mon Feb 1 17:12:05 2016
INFO: EBACA certificate validity end = Thu Jan 29 17:12:05 2026
Number of attributes which qualify for movement to new containers : 1.
2. The report indicates there is an attribute that qualifies for indexing. The next step is to find the name of the attribute. This list of attribute names can be found in the dsContainerReadyAttrs attribute of the Pseudo Server and is viewable in iMonitor.
Log into iMonitor then click on the Agent Configuration link found on the left frame. Towards the end of the Connection Information section in the middle of the screen the Pseudo Server's EID can be seen. In this case it is 8007. Click on it.
The Pseudo Server's attributes are now displayed. Click on the dsContainerReadyAttrs attribute link on the left then note the name of the attribute(s) displayed. In this example it is SAS:Vendor Support.
3. Run the ndsrepair command to kick off the indexing of this attribute's values. The syntax of the command is:
ndsrepair -J <Pseudo server object ID> -Ad -am <attribute name>
Using this above example:
ndsrepair -J 8007 -Ad -am "SAS:Vendor\ Support"(Any spaces in the attribute name must be escaped as shown above.)
[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf: 90svr1.O=emg.HV9_TREE1
Repair utility for NetIQ eDirectory 9.0 - 9.0 v40002.41
DS Version 40002.79 Tree name: HV9_TREE1
Server name: .90svr1.emg
Size of /var/opt/novell/eDirectory/log/ndsrepair.log = 6942 bytes.
Preparing Log File "/var/opt/novell/eDirectory/log/ndsrepair.log"
Please Wait...
Single Object Repair
Start: Saturday, February 06, 2016 16:18:31 Local Time
[Pseudo Server]
Total Objects = 1, UNKNOWN class objects = 0, Total Values = 38
Thread to do attribute movement started successfully for attribute: SAS:Vendor Support
Total errors: 0
NDSRepair process completed.
MONITORING
Monitoring of the process and its completion can be done performed with ndstrace using the +RECM flag.
Attribute maintenance thread: Starting move of attribute 729 (out of entries)
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 0064
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 00C8
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 012C
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 0190
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 01F4
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 0258
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 02BC
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 0320
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 0384
Attribute maintenance thread is running for: Attribute 729, number of entries scanned so far: 03E8
Attribute maintenance thread: Move of attribute 729 finished with status code of 0000
Iter #d842760 setIndex( 261)
Iter #d842760 query PartID==4 && Obituary$257A$
Iter #eb7b8e0 setIndex( 261)
Iter #eb7b8e0 query PartID==4 && Obituary$257A$
Iter #a0f7a700 setIndex( 261)
Iter #a0f7a700 query PartID==4 && Obituary$257A$
Iter #a0f7a700 index = Obituary$IX$261
Iter #a0f7a700 first( ID_INVALID)
Iter #a0f7a700 setIndex( 261)
Iter #a0f7a700 query PartID==4 && Obituary$257A$
Iter #a0f7a700 index = Obituary$IX$261
Iter #a0f7a700 first( ID_INVALID)
Iter #a1a85700 setIndex( 261)
Iter #a1a85700 query PartID==4 && Obituary$257A$
Iter #a1a85700 index = Obituary$IX$261
Iter #a1a85700 first( ID_INVALID)
Iter #8d1d3700 setIndex( 261)
Iter #8d1d3700 query PartID==4 && Obituary$257A$
Iter #8d1d3700 index = Obituary$IX$261
Iter #8d1d3700 first( ID_INVALID)
MAKING THIS AUTOMATIC
To bring back the old behavior of immediately creating these indexes when the conditions are met add the following line to the _ndsdb.ini file and restart eDirectory:
enablemovetoattrcontainer=1NOTE: A new installation of eDirectory 9.0.2 or later will use automatic indexing.