Contained Within
Find More Documentation
Featured Support Resources
|  Download this book in PDF (3673 KB)
dsconf(1M)
NAME
| Synopsis
| Description
| SUBCOMMANDS
| GLOBAL OPTIONS
| SUBCOMMAND OPTIONS
| Operands
| Description
| EXIT STATUS
| Examples
| Attributes
| See Also
NAME
dsconf – Manages Directory Server configuration
Synopsis
install-path/ds6/bin/dsconf
subcommand options
Description
The dsconf command manages Directory Server configuration.
It enables you to modify the configuration entries in cn=config.
The server must be running in order for you to run dsconf.
SUBCOMMANDS
GLOBAL OPTIONS
The following options are global, and are applicable to all commands
and subcommands.
-
-?
--help
-
Displays help information for a command or subcommand.
-
-c
--accept-cert
-
Does not ask for confirmation before accepting non-trusted
server certificates.
-
-D USER_DN
--user-dn USER_DN
-
Binds as USER_DN. dsconf searches
for a USER_DN value in the following order: First
a a USER_DN specified in the command line, then
a USER_DN set by using the environment variable
$LDAP_ADMIN_USER. If none of these are found, the default is to bind as the
user cn=Directory Manager.
-
-e
--unsecured
-
Connects over LDAP with no secure connection. To connect over
a clear connection by default, set the DIRSERV_UNSECURED environment
variable.
-
-h HOST
--hostname HOST
-
Connects to the directory on HOST.
dsconf contacts the LDAP server on the specified host, which may be a host
name or an IP address. dsconf searches for a HOST value in the following order: First a HOST specified
on the command line, then a HOST set by using the
environment variable $DIRSERV_HOST. If none of these are found, the default
is to use the local host.
For example, when mapping the IPv4 address 192.168.0.99 to
IPv6, specify the HOST:PORT as follows: ::ffff:192.168.0.99.
-
-i
--no-inter
-
Does not prompt for confirmation before performing the operation.
-
-j
--reject-cert
-
Does not ask for confirmation before rejecting non-trusted
server certificates (for current session only).
-
-p PORT
--port PORT
-
Connects to directory on PORT. dsconf searches for a PORT value in the
following order: First aPORT specified in the command
line, then a PORT set by using the environment
variable $DIRSERV_PORT. If none of these are found, the default is to use
port 389.
This option is mutually exclusive with -P,--secure-port.
-
-P PORT
--secure-port PORT
-
Connects over SSL to the directory on PORT.
The dpconf command searches for a PORT value
in the following order:
If none of these are found, the default is to use port 636.
This option is mutually exclusive with -p,--port.
-
-v
--verbose
-
Displays extra information.
-
-V --version
-
Displays the current version of dsconf.
The version is provided in the format year.monthday.time.
So version number 2007.1204.0035 was built on December
4th, 2007 at 00h35. If the components used by dsconf are
not aligned, the version of each individual component is displayed.
-
-w FILE
--pwd-file FILE
-
Binds using an LDAP password is read from FILE. dsconf searches for a password FILE value
in the following order: A password or password file specified
in the command line. A password file set by using the environment
variable $LDAP_ADMIN_PWF. If none of these are found, the default
is to prompt for the password.
-
-y
--decrypt-attr
-
Decrypts encrypted attributes. The --decrypt-attr option
is a boolean and is optional.
SUBCOMMAND OPTIONS
Operands
Description
Syntax values shown in lower case or partly in lower case are literal
values.
Those shown in upper case are syntax types, defined as follows:
-
ATTR_NAME
-
A valid attribute type name such as cn or objectClass.
-
DN
-
A valid distinguished name such as ou=People,dc=example,dc=com.
-
DURATION
-
A duration specified in months (M), weeks
(w), days (d), hours (h),
minutes (m), seconds (s), and miliseconds
(ms), or some combination with multiple specifiers. For
example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s.
You can also specify one week as 1w0d0h0m0s.
DURATION properties typically do not each support
all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration
specifiers are supported.
-
INTEGER
-
A positive integer value between 0 and the maximum supported
integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.
-
INTERVAL
-
An interval value of the form hhmm-hhmm 0123456, where the
first element specifies the starting hour, the next element the finishing
hour in 24-hour time format, from 0000-2359,
and the second specifies days, starting with Sunday (0)
to Saturday (6).
-
LDAP_URL
-
A valid LDAP URL as specified by RFC 2255.
-
MEMORY_SIZE
-
A memory size specified in gigabytes (G),
megabytes (M),kilobytes (k), or bytes
(b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.
-
OCTAL_MODE
-
A three-digit, octal file permissions specifier. The first
digit specifies permissions for the server user ID, the second for the server
group ID, the last for other users. Each digit consists of a bitmask defining
read (4), write (2), execute (1),
or no access (0) permissions, thus 640 specifies
read-write access for the server user, read-only access for other users of
the server group, and no access for other users.
-
PATH
-
A valid, absolute file system path.
-
STRING
-
A DirectoryString value, as specified by RFC 2252.
-
TIME
-
A time of the form hhmm in 24-hour
format, where hh stands for hours and mm stands
for minutes.
EXIT STATUS
Examples
The following examples show how the dsconf command
is used.
Example 1 Create a Suffix
$ dsconf create-suffix -h host -p port
dc=example,dc=com
|
In this example, non-default ports are specified.
Check to see if the suffix has been created.
$ dsconf list-suffixes -h host -p port -v
|
Example 2 Import LDIF Data into the Suffix
$ dsconf import -h host -p port
/local/ds/ldif/example.ldif dc=example,dc=com
|
Example 3 Index an Attribute
In this example, the preferredLanguage attribute
is going to be indexed.
-
Create an index entry for the attribute. By default, the index
matching types are equity and presence.
$ dsconf create-index -h host -p port
dc=example,dc=com preferredLanguage
|
-
Check that the index entry has been created
$ dsconf get-index-prop -h host -p port
dc=example,dc=com preferredLanguage
|
-
Generate the index for the attribute.
$ dsconf reindex -h host -p port
-t preferredLanguage dc=example,dc=com
|
Example 4 Back Up the Directory Server Data
$ dsconf backup -h host -p port
/tmp/backupArchiveDir
|
For complete backup procedures, see the Sun Java System Directory Server Enterprise Edition Administration Guide.
Example 5 Monitor and Change Cache Size for a Suffix
-
Search for the string cache within the dsconf help properties:
$ dsconf help-properties | grep cache
|
-
Determine which property is most applicable and request more
information. In the results of the preceding step, cache-mem-size seems
to correspond. For additional information, use the verbose option:
$ dsconf help-properties -v | grep entry-cache-size
SUF entry-cache-size rw MEMORY_SIZE (Ex: 3G,2m,200k,10000b)
nsslapd-cachememsize
Cache size in term of memory space: (Default: 10M)
|
Use the following information to interpret the results above:
-
SUF
-
This property applies to a suffix.
-
entry-cache-size
-
The name of the property
-
rw
-
You have read and write access to the property when using get-suffix-prop and set-suffix-prop.
-
MEMORY_SIZE
-
Use memory size values as described in this man page.
-
nsslapd-cachememsize
-
The attribute under cn=config to which
this property applies.
-
(Default: 10M)
-
The default value of this property
-
Determine the current value of entry-cache-size:
$ dsconf get-suffix-prop -h host -p port
dc=example,dc=com entry-cache-size
entry-cache-size : 10M
|
-
Change the value of entry-cache-size to 12M:
$ dsconf set-suffix-prop -h host -p port
dc=example,dc=com entry-cache-size:12M
|
-
Check that the value has been changed:
$ dsconf get-suffix-prop -h host -p port
dc=example,dc=com entry-cache-size
entry-cache-size : 12M
|
Example 6 Export to LDIF While Using Filters
$ dsconf export -h host -p port
-f not-print-entry-ids -s ou=people,dc=example,dc=com
-s ou=contractors,dc=example,dc=com dc=example,dc=com
/local/ds/ldif/export.ldif
|
This example shows a command that:
-
Uses the flag not-print-entry-ids to request
that entry IDs are not exported.
-
Exports data from two suffixes ou=people,dc=example,dc=com and ou=contractors,dc=example,dc=com into one
LDIF file /local/ds/ldif/export.ldif.
Example 7 Rotate the Access Log and Modify the Rotation Delay for the
Access Log
If you have a log which is getting very large, you can rotate the log.
Rotation backs up the existing log file and creates a fresh log file. In this
example, the access log is rotated.
-
Rotate the access log by using the command:
$ dsconf rotate-log-now -h host -p port access
|
-
You can now modify the delay between log rotations for the
access log.
Find the property which sets maximum log size:
$ dsconf help-properties -v | grep LOG
|
The output from the previous command shows that the required property
is rotation-interval.
-
To see the default setting for rotation-interval:
$ dsconf get-log-prop -h host -p port
access rotation-interval
|
The default is one day 1d.
-
To increase the rotation delay to two days, use the command:
$ dsconf set-log-prop -h host -p port
access rotation-interval:2d
|
Example 8 Configure Replication in a Two-Master Topology
This procedure configures replication on a topology with two severs,
and both are masters. Replication is configured first on one master, then
on the second master. Master 1 is located on server1.example:1389.
Master 2 is located on server2.example:2389.
-
On server 1: Create a suffix
$ dsconf create-suffix -h server1.example -p 1389
dc=example,dc=com
|
-
On Server 1: Populate the suffix with LDIF data
$ dsconf import -a -h server1.example -p 1389
/opt/SUNWdsee/ds6/ldif/Example.ldif dc=example,dc=com
|
If the import takes a long time, you can obtain status on the import
operation using:
$ dsconf info -h server1.example -p 1389
|
or
$ dsconf show-task-status -h server1.example -p 1389 -v
|
Alternatively, you can view the status of the task while it is running
by omitting the -a option in the command.
-
On Server 1: Enable replication on Master 1. This step assigns
a replication role and ID to an existing suffix. It also sets the replication
manager bind DN to the default replication manager DN.
$ dsconf enable-repl -h server1.example -p 1389
-d 1 master dc=example,dc=com
|
-
On server 2: Create a suffix
$ dsconf create-suffix -h server2.example -p 2389 dc=example,dc=com
|
-
On Server 2: Enable replication on Master 2. This step assigns
a replication role and ID to an existing suffix. It also sets the replication
manager bind DN to the default replication manager DN.
$ dsconf enable-repl -h server2.example -p 2389
-d 2 master dc=example,dc=com
|
-
On Server 1: Create a replication agreement from Master 1
to Master 2.
$ dsconf create-repl-agmt -h server1.example -p 1389
dc=example,dc=com server2.example:2389
|
-
On Server 2: Create a replication agreement from Master 2
to Master 1
$ dsconf create-repl-agmt -h server2.example -p 2389
dc=example,dc=com server1.example:1389
|
-
On Server 1: Check that the replication agreement status is
OK.
$ dsconf show-repl-agmt-status -h server1.example -p 1389
dc=example,dc=com server2.example:2389
|
If the status is not OK, then accord the replication agreement.
$ dsconf accord-repl-agmt -h server1.example -p 1389
dc=example,dc=com server2.example:2389
|
-
On Server 1: From Master 1, initialize replication on Master
2. This step initializes Master 2 with the data contained in the suffix on
Master 1 and starts replication.
$ dsconf init-repl-dest -h server1.example -p 1389
dc=example,dc=com server2.example:2389
|
The replication agreements in both directions are now active and replication
is running.
Attributes
See Also
DS 6.3 Last Revised 7 Dec 2007
NAME
| Synopsis
| Description
| SUBCOMMANDS
| GLOBAL OPTIONS
| SUBCOMMAND OPTIONS
| Operands
| Description
| EXIT STATUS
| Examples
| Attributes
| See Also
|
