Chapter 2   Core Server Configuration Reference

Within a configuration entry, each attribute is represented as an attribute name. The value of the attribute corresponds to the attribute's configuration.

Code Example 2-1 gives an example of part of the dse.ldif file for a Directory Server. The example shows, among other things, that schema checking has been turned on; this is represented by the attribute nsslapd-schemacheck, which takes the value on.

The configuration for each part of Directory Server plug-in functionality has its own separate entry and set of attributes under the subtree cn=plugins,cn=config. Code Example 2-2 shows the configuration entry for an example plug-in, the Telephone Syntax plug-in.

The cn=NetscapeRoot and cn=UserRoot subtrees contain configuration data for the databases containing the o=NetscapeRoot and o=UserRoot suffixes.

• The cn=NetscapeRoot subtree contains the configuration data used by the Netscape Administration Server for authentication and all actions that cannot be performed through LDAP (such as start/stop).
  
  
• The cn=UserRoot subtree contains all the configuration data for the first user-defined database created during server installation. The cn=UserRoot subtree is called UserRoot by default. However, this is not hard-coded, and, given the fact that there will be multiple database instances, this name will be changed and defined by the user at the time new databases are added.

Configuration information for indexing is stored as entries in the Directory Server under the following information-tree nodes:

• cn=index,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config
  
  
• cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config
  
  
• cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config

For more information regarding indexes in general, see Netscape Directory Server Administrator's Guide. For information regarding the index configuration attributes, see Database Attributes under cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config. The attributes are presented here because this node is the first to appear in our representation of the configuration attributes that is based on the cn=config information tree.

These default ACIs allow all LDAP operations to be carried out on all configuration attributes by the following users:

• Members of the Configuration Administrators Group.
  
  
• The user acting as the Administrator, who has the UID admin that can be configured at installation time.
  
  
• Members of local Directory Administrators Group.
  
  
• The local Directory Administrator (root DN).
  
  
• The SIE (Server Instance Entry) Group, usually assigned using the Set Access Permissions from the main topology view in the main console.

For more information on Access Control, see the  Netscape Directory Server Administrator's Guide.

The configuration entries in the directory can be searched and modified using LDAP either via the Netscape Console or by performing ldapsearch and ldapmodify operations in the same way as other directory entries. The advantage of using LDAP to modify entries is that you can make the changes while the server is running. You must remember to specify the port number when modifying configuration entries since the server is not necessarily running on port 389. For further information, see chapter 2, "Creating Directory Entries," in the  Netscape Directory Server Administrator's Guide. However, certain changes do require the server to be restarted before they are taken into account. See Configuration Changes Requiring Server Restart for further information.

The entire configuration, including attributes that always take default values, can be viewed by performing an ldapsearch operation on the cn=config subtree:

ldapsearch -b cn=config -D bindDN -w password

where bindDN is the DN chosen for the Directory Manager when the server was installed and password is the password chosen for Directory Manager. For more information on using ldapsearch, see ldapsearch.

Previously, we saw an example of the configuration entry for the Telephone Syntax plug-in where the plug-in is enabled. If you wanted to disable this feature, you might use the following series of commands to implement this change.

Certain restrictions apply when modifying server entries and attributes:

• The cn=monitor entry and its child entries are read-only and cannot be modified.
  
  
• If an attribute is added to cn=config, the server will ignore it.
  
  
• If an invalid value is entered for an attribute, this will be ignored by the server.
  
  
• Because ldapdelete is used for deleting an entire entry, you should use ldapmodify if you want to remove an attribute from an entry.

Some configuration attributes cannot be altered dynamically while the server is running. In these cases, for the changes to take effect, the server needs to be shut down and restarted. The modifications should be made either through the Directory Server Console or by manually editing the dse.ldif file. Table 2-4 under Configuration Quick Reference Tables at the end of this chapter contains a list of these attributes.

Turns access control on and off. If this attribute has a value off, then any valid bind attempt (including an anonymous bind) results in full access to all information stored in the Directory Server. 

Specifies the path and filename of the log used to record each database access. The following information is recorded by default in the log file:

• IP address of the client machine that accessed the database.
  
  
• Operations performed (for example: search, add, modify).
  
  
• Result of the access (for example: the number of entries returned).

For more information on turning access logging off, see chapter 12, "Monitoring Server and Database Activity," in the Netscape Directory Server Administrator's Guide.

For access logging to be enabled, this attribute must have a valid path and filename, and the nsslapd-accesslog-logging-enabled configuration attribute must be switched to on. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging. 

Controls what is logged to the access log. 

This read-only attribute, which cannot be set, provides a list of access log files used in access log rotation. 

When set to off, the server writes all access log entries directly to disk. 

Specifies the maximum age that a log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit attribute. 

Specifies the units for nsslapd-accesslog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire. 

Disables and enables accesslog logging but only in conjunction with the nsslapd-accesslog attribute that specifies the path and filename of the log used to record each database access.

For access logging to be enabled, this attribute must be switched to on, and the nsslapd-accesslog configuration attribute must have a valid path and filename. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging. 

Specifies the maximum amount of disk space in megabytes that the access logs are allowed to consume. If this value is exceeded, the oldest access log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also, remember that there are three different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log. 

Specifies the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest access log is deleted until enough disk space is freed to satisfy this attribute. 

Specifies whether access log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way enables you to generate log files at a specified time during a day, such as midnight to midnight everyday. This makes analysis of the log files much easier because they then map directly to the calendar.

For access log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-accesslog-logrotationsynchour and nsslapd-accesslog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate access log files everyday at midnight, enable this attribute by setting its value to on and then set the values of the  nsslapd-accesslog-logrotationsynchour and nsslapd-accesslog-logrotationsyncmin attributes to 0. 

Specifies the hour of the day for rotating access logs. This attribute must be used in conjunction with nsslapd-accesslog-logrotationsync-enabled and nsslapd-accesslog-logrotationsyncmin attributes. 

Specifies the minute of the day for rotating access logs. This attribute must be used in conjunction with nsslapd-accesslog-logrotationsync-enabled and nsslapd-accesslog-logrotationsynchour attributes. 

Specifies the time between access log file rotations. The access log will be rotated when this time interval is up, regardless of the current size of the access log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-accesslog-logrotationtimeunit attribute.

Although it is not recommended for performance reasons to specify no log rotation since the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-accesslog-maxlogsperdir attribute value to 1 or the nsslapd-accesslog-logrotationtime attribute to -1. The server checks the nsslapd-accesslog-maxlogsperdir attribute first, and if this attribute value is larger than 1, the server then checks the nsslapd-accesslog-logrotationtime attribute. See nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files) for more information. 

Specifies the units for the nsslapd-accesslog-logrotationtime attribute. 

Specifies the maximum access log size in megabytes. When this value is reached, the access log is rotated. That means the server starts writing log information to a new log file. If you set nsslapd-accesslog-maxlogsperdir attribute to 1, the server ignores this attribute.

When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also, remember that there are three different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log. 

Specifies the total number of access logs that can be contained in the directory where the access log is stored. If you are using log file rotation, then each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored on this attribute, then the oldest version of the log file is deleted. For performance reasons, it is not recommended that you set this value to 1 because the server will not rotate the log, and it will grow indefinitely.

If the value for this attribute is higher than 1, then you need to check the nsslapd-accesslog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-accesslog-logrotationtime attribute has a value of -1, then there is no log rotation. See nsslapd-accesslog-logrotationtime (Access Log Rotation Time) for more information. 

Specifies the access mode or file permission with which access log files are to be created. The valid values are any combination of 000 to 777 since they mirror numbered or absolute UNIX file permissions. The value must be a combination of a 3-digit number, the digits varying from 0 through 7:

0 - None
1 - Execute only
2 - Write only
3 - Write and execute
4 - Read only
5 - Read and execute
6 - Read and write
7 - Read, write, and execute

In the 3-digit number, the first digit represents the owner's permissions, the second digit represents the group's permissions, and the third digit represents everyone's permissions. When changing the default value, keep in mind that 000 will not allow access to the logs and that allowing write permissions to everyone can result in the logs being overwritten or deleted by anyone.

The newly configured access mode will only affect new logs that are created; the mode will be set when the log rotates to a new file. 

Allows non-standard characters in attribute names to be used for backwards compatibility with older servers. 

Specifies the pathname and filename of the log used to record changes made to each database. 

For audit logging to be enabled, this attribute must have a valid path and file name, and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on . The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging. 

Provides a list of audit log files. 

Specifies the maximum age that a log file is allowed to be before it is deleted. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logexpirationtimeunit attribute. 

Specifies the units for the nsslapd-auditlog-logexpirationtime attribute. If the unit is unknown by the server, then the log will never expire. 

Turns audit logging on and off. 

For audit logging to be enabled, this attribute must have a valid path and file name and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on. The table below lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging. 

Specifies the maximum amount of disk space in megabytes that the audit logs are allowed to consume. If this value is exceeded, the oldest audit log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also remember that there are three different log files (access log, audit log, and error log) maintained by the Directory Server, each of which will consume disk space. Compare these considerations with the total amount of disk space that you want to be used by the audit log. 

Specifies the minimum permissible free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest audit log is deleted until enough disk space is freed to satisfy this attribute. 

Specifies whether audit log rotation is to be synchronized with a particular time of the day. Synchronizing log rotation this way enables you to generate log files at a specified time during a day, such as midnight to midnight everyday. This makes analysis of the log files much easier because they then map directly to the calendar.

For audit log rotation to be synchronized with time-of-day, this attribute must be enabled with the nsslapd-auditlog-logrotationsynchour and nsslapd-auditlog-logrotationsyncmin attribute values set to the hour and minute of the day for rotating log files.

For example, to rotate audit log files everyday at midnight, enable this attribute by setting its value to on and then set the values of the  nsslapd-auditlog-logrotationsynchour and nsslapd-auditlog-logrotationsyncmin attributes to 0. 

Specifies the hour of the day for rotating audit logs. This attribute must be used in conjunction with nsslapd-auditlog-logrotationsync-enabled and nsslapd-auditlog-logrotationsyncmin attributes. 

Specifies the minute of the day for rotating audit logs. This attribute must be used in conjunction with nsslapd-auditlog-logrotationsync-enabled and nsslapd-auditlog-logrotationsynchour attributes. 

Specifies the time between audit log file rotations. The audit log will be rotated when this time interval is up, regardless of the current size of the audit log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logrotationtimeunit attribute. If you set the nsslapd-auditlog-maxlogsperdir attribute to 1, the server ignores this attribute.

Although it is not recommended for performance reasons to specify no log rotation, as the log will grow indefinitely, you have two ways of specifying this. Either you set the nsslapd-auditlog-maxlogsperdir attribute value to 1 or the nsslapd-auditlog-logrotationtime attribute to -1. The server checks the nsslapd-auditlog-maxlogsperdir attribute first, and, if this attribute value is larger than 1, the server then checks the nsslapd-auditlog-logrotationtime attribute. See nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files) for more information. 

Specifies the units for the nsslapd-auditlog-logrotationtime attribute. 

Specifies the maximum audit log size in megabytes. When this value is reached, the audit log is rotated. That means the server starts writing log information to a new log file. If you set nsslapd-auditlog-maxlogsperdir to 1, the server ignores this attribute.