2

I have installed an openldap server with memberof function on centos via slapd.conf: needed part of config?:

index objectClass                       eq,pres
index ou,cn,surname,givenname           eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

in openldap logs:

SRCH attr=uid displayName mail member
Jun 21 15:53:52 rhsfugt001 slapd[26924]: <= bdb_equality_candidates: (memberOf) not indexed

i havent found a solution to fix this...

Improve this question

2 Answers 2

Reset to default
4

It's just a warning saying that some attributes used in a filter for that particular search result were not indexed.

Whether indexing an attribute or not makes sense can only be determined by looking at the filter causing this warning.

You can also significantly lower search performance when adding indexes for attributes with large result sets for a distinct value.

Typical example for an indexing anti-pattern:

Let's assume (uid=foobar) always returns one search result.

So obviously you index attribute uid:

index uid eq

Now it's quite common to have slightly more complex filters, e.g. for searching only "active" users:

(&(uid=foobar)(organizationalStatus=active))

If you have many users matching (organizationalStatus=active) the search performance will be significantly worse if you just an index because of this unindexed warning!

The reason is that for each indexed attribute a search candidate set is generated and in a second step the search candidate sets are filtered with the unindexed assertions. So in the above example index uid eq will result in a search candidate set cardinality of one, while index uid,organizationalStatus eq will produce two search candidate sets, uid still with cardinality one, but organizationalStatus with cardinality all.

=> Do not add an index just to get rid of the warning without analyzing the search filters used and the possible sizes of the search candidate sets!

Improve this answer
-2

I fixed this warning by reindexing:

systemctl stop slapd
rm /var/lib/ldap/alock
slapindex

chown -R ldap:ldap /var/lib/ldap/
systemctl start slapd
Improve this answer
3
  • Did you examine the filter leading to this warning? As said randomely adding indexes can lead to worse performance! Following this warning without filter analysis is so harmful that I've disabled it in my own OpenLDAP builds.
    – Michael Ströder
    Aug 17, 2018 at 16:59
  • I reindexed this and the warning message dont come up anymore. It is solved.
    – mostworld77
    Aug 18, 2018 at 17:19
  • It seems you want to just get rid of a warning but that's not the right answer. I've improved my answer to make clear at least for others stumbling across this question that just blindly adding an index is not the right solution. In my own OpenLDAP packages I've even patched away this warning because it does not make sense. See also: OpenLDAP ITS#7796
    – Michael Ströder
    Aug 18, 2018 at 22:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .