6

I am trying to setup backup and restore and make sure it works.

Please note that database size on ldap.old is lot more then the ldap. The /var/lib/ldap.old is my existing database. I have renamed /var/lib/ldap for backup/restore testing.

I am getting the following error when restoring. Because of this I am not sure I have successfully restored everything.

...
added: "uid=user11123,ou=Abcd,ou=Industry Professional,dc=testdomain,dc=org" (0001cc9f)
added: "uid=user13123,ou=Abcd,ou=Industry Professional,dc=testdomain,dc=org" (0001cca0)
Error, entries missing!
  entry 79870: ou=industryprofessional,dc=testdomain,dc=org
  entry 79871: ou=abcd professional,ou=industryprofessional,dc=testdomain,dc=org

Disk usage:

[root@openldap]# du -khs ldap ldap.old/
3.3G    ldap
4.0G    ldap.old/

Here is my backup / restore process:

Backup:

slapcat -v -l backup_openldap.ldif

Restore:

/etc/init.d/ldap stop
mv /var/lib/ldap /var/lib/ldap.old
mkdir /var/lib/ldap
chmod go-rwx /var/lib/ldap
cp –rfp /var/lib/ldap.old/DB_CONFIG /var/lib/ldap

slapadd –v –l backup_openldap.ldif

chown ldap:ldap /var/lib/ldap
/etc/init.d/ldap start

How do I validate that I have restore all records successfully?

Tombart
  • 2,630
  • 5
  • 26
  • 39
Raza
  • 4,059
  • 7
  • 28
  • 33

1 Answers1

4

First of all you should be aware of slapcat's limitations:

For some backend types, your slapd(8) should not be running 
(at least, not in read-write mode) when you do this to ensure 
consistency of the database. It is always safe to run slapcat 
with the slapd-bdb(5), slapd-hdb(5), and slapd-null(5) backends.

So you better pack that backup in /etc/init.d/ldap stop and /etc/init.d/ldap start as well.

Before restarting ldap in the restore procedure, you can dump the just loaded data to a temporary file and compare that to the LDIF file you just used as input. I am pretty sure the LDIF output for slapcat is sorted by Distinguished Names so a diff should exit with exit-code 0.

...
chown ldap:ldap *

slapcat -l /var/tmp/test.ldif
diff /var/tmp/test.ldif /backup/openldap/backup_ldap2.diff
if [ $? != 0 ] ; then
     echo 'differences found'
fi

/etc/init.d/ldap start

This of course assumes that slapcat is working correctly. If you do not trust that you should extract all data relevant to you, from the running DB with ldap_search_ext(), generate some output (dump or checksum) from that, and compare that with running the same code on the restored database (after starting ldap of course). That way you would notice if some data relevant to your usage is left out of the dump by slapcat (unlikely, but possible if it has a bug)

Anthon
  • 78,313
  • 42
  • 165
  • 222