Comparison of edirectory Versions

Transcription

1 APPENDIX Comparison of edirectory Versions There have been many different versions of edirectory over the past several years. From its early existence, edirectory has progressed from NDS 5.x, NDS 6.x, NDS 7.x, and NDS 8.x, to edirectory 8.5.x, edirectory 8.6.x, edirectory 8.7.x, and now edirectory 8.8. Between NDS 7.x and NDS 8.x, the database structure was changed from a RecMan, linked-list database to a FLAIM, tagged database. FLAIM is much more scalable and robust. After NDS 8 shipped, Novell started porting the directory to other platforms. There were variations of NDS 8 that shipped on Windows and Linux. However, the name was changed from NDS to edirectory with edirectory 8.5, which was really the first full cross-platform identity management directory. The different versions of edirectory have stabilized the back end, made the directory more secure and more scalable, and opened up several new interfaces to the directory, which made it more adaptable as well. The purpose of this appendix is to provide a very high-level feature comparison between edirectory 8.6.x, edirectory 8.7.x, and edirectory 8.8. This information will be valuable to you as you move forward with Novell in implementing the latest and greatest in the identity management space. Although each new version of edirectory may contain new features, some of these features are very subtle. It is beyond the scope of this appendix to list all the features. Thus, this appendix discusses only the major feature set changes. 277

2 278 APPENDIX COMPARISON OF edirectory VERSIONS Changes in edirectory 8.6.x The main focus of edirectory 8.6.x was synchronization. The internal versions of edirectory 8.6.x range from version xx to version xx. The main features introduced in edirectory 8.6.x are as follows: Note edirectory 8.6.x is currently discontinued. It is no longer shipped, maintained, or supported by Novell. Faster replica synchronization: Several replication enhancements were added to edirectory 8.6.x, some of which are listed here: Multithreaded outbound synchronization: Multiple threads can be used to complete an outbound synchronization. You can specify whether the threads are allocated by partition or by server. In the past, synchronization was one threaded. Multithreading not only increases performance but also is more fault tolerant. In the past, if the one thread was tied up talking to a slow-responding server, no other servers in the replica rings could get updates. Now, only the slow-responding server misses the updates, because other threads can service all the other servers in the replica ring. Synchronization points: Synchronization points track the synchronization process. If an error occurs, the entire synchronization is not started over. The synchronization can continue where it left off. Greatest Value Time Stamp (GVTS): A new vector called GVTS was introduced. This enabled the edirectory agent to scan only the GVTS to find updates, instead of scanning every value within an entry. This feature greatly enhanced performance with the synchronization process. Dynamic groups: Dynamic groups offer a lot of advantages when dealing with group memberships. Unlike static groups, dynamic groups do not have static memberships. They have what is called a memberquery filter, an LDAP query string that defines which members may be in the group. If a particular object meets the criteria specified, it is automatically deemed a member of the group and receives all the rights that the dynamic group contains. This alleviates the need for very large, multivalued membership lists that require a lot of memory and processor power when synchronized. Dynamic groups also speed up login times because they are not used to calculate the original Security Equivalence Vector (SEV).

3 APPENDIX COMPARISON OF edirectory VERSIONS 279 Improved transitive vector synchronization: The packet structure for synchronization traffic is more defined and more efficient. Fewer packets are required to finish a synchronization and merge transitive vectors. Improved obituary process: In the past, the obituary process used the purge vector to determine whether or not an obituary needed to be processed. Unfortunately, the purge vector is updated by the synchronization process. There were certain scenarios in which the purge vector would be updated before all of the obituaries were processed. The end result was that obituaries would be orphaned. To remedy the issue, edirectory introduced the obituary vector. This vector is stored in memory and provides a better way to track whether or not obituaries have been seen by all servers. The end result is that if the master of the partition is edirectory or greater, you will rarely see a stuck obituary. Improved auxiliary class support: Novell started development of auxiliary classes with NDS 8.x. As time has passed, defects have been fixed and issues have been resolved so that auxiliary classes are backward compatible and work as they were intended. Changes in edirectory The main focus of edirectory was improvement of the security and management interfaces. The internal versions of edirectory range from version to version xx. Note edirectory is discontinued. It is no longer shipped, maintained, or supported by Novell. At the time of this writing, edirectory is the currently supported version of edirectory 8.7.x. For current information about the product lifecycle, see The main features introduced in edirectory are as follows: Enhanced backup and restore capabilities: edirectory 8.7 introduced a new focus for backup and restore, called hot continuous backup. Hot continuous backup was introduced using the Backup emtool. The backup provides online backup with a restore that supports transactional replay to bring the data right back up to the state it was in when the server went down.

4 280 APPENDIX COMPARISON OF edirectory VERSIONS Transport Layer Security (TLS): Support for TLS/SSL services based on the OpenSSL source code was introduced. This is all provided through the NTLS modules. Enhanced dynamic groups: The ability to convert existing static groups to dynamic groups was added. SASL support for edirectory and LDAP logins: Support was added for Simple Authentication and Security Layer (SASL), an authentication negotiation framework that allows the use of various other authentication methods. edirectory event monitoring: The event system was exposed on all platforms, allowing for cross-platform event monitoring. Extensible match LDAP search filters: Provides partial support for extensible match (defined in LDAPv3, RFC 2251) for matching on DN attributes. This allows inclusion of DN elements in the search criteria. At the time of this writing, it does not yet support matching rules in the extensible match filter, and it ignores matching rules specified in the extensible match filter. Simple Network Management Protocol (SNMP) monitoring: Provides an SNMP subagent that has precompiled the edirectory MIB. imanager 1.5.2: Provided a web-based, cross-platform management tool that allowed you to administer your edirectory system from a web browser. imonitor 2.0: Provided detailed information about the directory over a secure port. You could monitor events, verbs, and other internal messages as well as view the raw data that was stored in the edirectory database. eguide 2.1: Provided a web-based corporate address book and selfadministration tool. eguide allowed users to get information about other users in the directory and modify their own information. It contained all the people, places, and things you needed to know in a single location.

5 APPENDIX COMPARISON OF edirectory VERSIONS 281 Changes in edirectory The main focus of edirectory was on new platform support and enhanced administration. The internal versions of edirectory range from version to version Note edirectory is discontinued. It is no longer shipped, maintained, or supported by Novell. At the time of this writing, edirectory is the currently supported version of edirectory 8.7.x. For current information about the product lifecycle, see The main features introduced in edirectory are as follows: New platform support: Support was added for the following additional platforms: Red Hat Linux 8.0, SuSE Linux Enterprise Server 8, Solaris 9, and HP-UX Improved indexing: Indexing was improved by increasing the size of keys that are supported. Universal Password: Universal Password provides strong, policy-based passwords that can be synchronized to disparate systems. It also uses the common UTF-8 encoding to support a universal character set. CloneDIB set: You can literally clone another server with all of its partitions and objects. The new server is added to the tree as if it were added through regular mechanisms. Clientless install: The ability to install edirectory on a Windows NT or 2000 server without the Novell Client was added. OpenSLP is installed on a clientless machine. Enhanced dynamic groups: The interface to configure dynamic groups was improved in imanager. Also, several bugs dealing with dynamic groups were resolved. imanager 2.0.1: Provided a single web-based management console for the administration of Novell products on NetWare 6.5, Windows, Linux, Solaris, AIX, and HP-UX. imonitor 2.1: New Advanced options were added and localization support was added. eguide 2.1.1: New provisioning enhancements were added.

6 282 APPENDIX COMPARISON OF edirectory VERSIONS Changes in edirectory The main focus of edirectory was on bug fixes. The internal versions of edirectory range from version to version 1055x.xx. Note edirectory has had several Interim Releases (IRs). These are bug fixes only. Open Enterprise Server (OES) shipped with edirectory IR5. OES SP1 shipped with edirectory SP7. The new features introduced in edirectory are as follows: Support for Microsoft Windows Server 2003: Was added to allow for the installation of edirectory on a Windows Server 2003 machine. UNIX package-based installation: Package installation for all edirectory server components for Linux, Solaris, and AIX was added. New memory manager: The open-source memory manager called HOARD was added to Windows to allow for higher scalability during heavy loads. An updated Geodesic memory manager was added to the Linux and UNIX builds to resolve memory leaks and dumping of cores. (The latest IR releases of removed Geodesic completely, using the Solaris native memory managers). Faster writes: Writing improvements were made, allowing two to three times more efficient writes. Default port change: The default port was changed from 80 and 443 to 8008 and 8010 for the HTTP stack for Windows, Linux, and UNIX. eguide 2.1.2: Provides support for Role-Based Services (RBS) used in imanager 2.0. Certificate Server 2.7: New features included OCSP over SSL and directory name CRL support. imanager 2.0.2: The installation for imanager was improved as was support for multivalue user-defined attribute administration. NMAS 2.3: New features in NMAS included advanced password policy enforcement, NMAS Web Server Agent, challenge/response login method, challenge response API, and Kerberos method.

7 APPENDIX COMPARISON OF edirectory VERSIONS 283 Changes in edirectory 8.8 The new features of edirectory 8.8 focus on scalability and encryption enhancements. The internal versions of edirectory 8.8 start with 201xx.xx. The main features introduced in edirectory 8.6.x are as follows: Security container caching: With Universal Password becoming more popular, an issue arose with scalability. Universal Password requires that each authentication request walks to the security container at the top of the tree. This can cause a slowdown in login attempts. edirectory 8.8 can cache the required information on the local server, which eliminates the need to walk the tree. Data import improvements: New switches are added to ICE to allow the throttling of the convergence of objects that are bulk-loaded into the tree. This prevents all servers from trying to synchronize data all at once after a large bulk load. Priority sync: A new synchronization method was added that allows you to specify specific attributes that you want sent immediately to all replicas. This will bypass change cache or the regular synchronization interval. Multiple instance support: The Linux and UNIX platforms now support multiple instances of the same tree or a different tree on the same server. Non-root installation: The Linux and UNIX platforms now support the installation and running of the edirectory process as a non-root user. Encrypted attributes: edirectory 8.8 provides the ability to define what attributes are encrypted on disk. In past versions of edirectory, the attributes that were encrypted were hard-coded and could not be changed. Encrypted synchronization: All platforms except NetWare will allow you to send synchronization data over a secure NCP channel. Backup/restore enhancements: Single-object backup and restore is now available through LDAP. Optimized LDAP searches: A new Ancestry ID is added to each object in the tree when edirectory 8.8 is installed. This new attribute is indexed, which enables the directory to now determine whether it will apply the base and scope first or the filter first. This will improve many LDAP search requests when the base and scope are limited. Case-sensitive passwords: edirectory 8.8 enables you to enforce case sensitivity with passwords with a non-nmas client.

8 Index Numbers schema-violation errors, occurrence of, 159, 161, 163, 167 Symbols! (exclamation mark), changing edirectory default settings with, & (ampersand) using with FLAIM database, 116 using with LDAP filters, 115 *. trigger in DSTRACE, description of, 215 (pipe) symbol using with FLAIM database, 116 using with LDAP filters, 115 ' (single quotes), using with LDAP Config, 219 A!a# DSTRACE command, setting -a* DSREPAIR options on NetWare/Windows, descriptions of, *a* DSTRACE triggers, descriptions of, 215 ACLs (access control lists), relationship to LDAP, Ad DSREPAIR option on *nix, description of, 185 add Audit:File object containment parameter, DSREPAIR options for, 186 add operation, performing with NDSConfig, 218 Advanced Mode in imonitor, turning on, 165 in DSREPAIR, 185 agent. See edirectory agent Agent Activity view in imonitor features of, , 149 troubleshooting processor high utilization with, Agent Buffers operation in DSTRACE, monitoring, 205 Agent Configuration page in imonitor features of, 140, troubleshooting processor high utilization with, Agent Health view in imonitor features of, 141, 148 finding synchronization errors with, 232 Agent Process Status view in imonitor displaying schema status with, 101 features of, 141, 149 resolving schema synchronization issues with, 233 Agent Requests operation in DSTRACE, monitoring, 207 Agent Summary view in imonitor, features of, 139, 146 Agent Synchronization view in imonitor, description of, 139, 146 AIX systems. See *nix operating systems Allocated Memory operation in DSTRACE, monitoring, 204 ampersand (&) using with FLAIM database, 116 using with LDAP filters, 115 AND ed expressions, impact on performance of LDAP queries, 116 anonymous binds configuring LDAP servers for, 128 disallowing, 129 anonymous LDAP queries, protecting servers from, 129. See also LDAP queries applications, analyzing in relation to indexes, 253 attribute definitions, modifying with LDIF, 106 attribute maps, relationship to LDAP group objects, 123 attribute types, testing for values of,

9 286 INDEX attributes, partition-specific attributes, 65, 68 Audit operations in DSTRACE, monitoring, 204 Authentication operation in DSTRACE, monitoring, 204 authentication server, determining, automated backups, performing, auxiliary classes enabling and disabling, 163 relationship to migration, 55 relationship to schema classes, 36 using, 109 B *b DSTRACE trigger, description of, 215!b# DSTRACE command, setting back up the database parameter, DSREPAIR options for, 193 backlink obituaries, description of, 172 Backlink process, high processor utilization by, 179 Backlinker operations in DSTRACE, monitoring, backup and restore strategies automated backups, best practices for, file system considerations related to, 88 multiple-server restore strategies, 89 for no additional requirements after restore, 87 and no data loss, overview of, 85 partitioning considerations related to, 88 remote capabilities for, 87 selective restore requirements for, 88 and size of DIB in edirectory, Backup embox tool, features of, 85 backup file header, role in hot continuous backups, backup options DIB backup through DSREPAIR, 82 DIBClone, 84 directory backup and restore in NWCONFIG, 81 file copy, hot continuous backups (Backup emtool), features of, NDSBackup, TSA Backup, 83 backup version field in DTD, description of, 91 backup_file field in DTD, description of, 92 backup_type field in DTD, description of, 91 backupcr file, description of, 90 backup.log file, example of, backups initiating through imanager, of security infrastructure, 98 backuptl file, description of, 90 base classes, relationship to Unknown objects, 162 bases, relationship to LDAP queries, 115 best practices for backup and restore strategies, for edirectory, 5 for Move SubTree operations, for partition merges, for partition splits, bindery issues, relationship to processor high utilization, bindery requests, high processor utilization by, 179 C -C* DSREPAIR options on *nix, descriptions of, 197 *c* DSTRACE triggers, descriptions of, 215 -c* ndstrce commands, descriptions of, 202 CA (Certificate Authority), troubleshooting, CA objects backing up, 98 preventing loss of, 87 cache. See FLAIM cache cache measurements in imonitor, types of, CCUser, extending for use with auxiliary classes, 109 Certificate Authority Server, finding, 34 Certificate Server in Security Infrastructure, binaries for and usage of, 28

10 INDEX 287 certificates accessing in imanager, 134 generation of, 27 troubleshooting, Change Cache operation in DSTRACE, monitoring, 205 check external references parameter, DSREPAIR options for, 197 check for duplicate time stamps parameter, DSREPAIR options for, 187 check obituaries parameter, DSREPAIR options for, 197 check the partition record parameter, DSREPAIR options for, 194 check transitive vectors parameter, DSREPAIR options for, 189 checkpoint interval, definition of, 258 checkpoint threads definition of, 258 relationship to disk I/O, child partitions definition of, 64 relationship to subordinate references, 70 class maps, relationship to LDAP group objects, 124 clear network addresses parameter, DSREPAIR options for, 192 clear WM:RegisteredWorkstation attributes parameter, DSREPAIR options for, 196 Client 32, troubleshooting slow logins with, Client Buffers operation in DSTRACE, monitoring, 206 collision rename objects identifying, resolving, 164 Collisions operation in DSTRACE, monitoring, 206 command-line utilities. See DSREPAIR command-line utility; DSTRACE command-line utility; EDIRUTIL command-line utility; ICE (Import convert Export) command-line utility; NDSBackup command-line utility; NDSConfig command-line utility; NDSLogin command-line utility; NDSsch command-line utility compression field in DTD, description of, 91 Conditions to Use Default Referral option, using with LDAP server option, 128. See also referrals configuration page, accessing for HTTP stack, 157 configure log file location parameter, DSREPAIR options for, 191 connection information, getting with imonitor, 230 connection methods, relationship to LDAP binds, 113 connection problems, finding with DSTRACE, 230 Connection Trace operation in DSTRACE, monitoring, 206 connections information, locating in LDAP server objects, 122 Connections view in imonitor, features of, 142, 149 ConsoleOne administrative tool, features of, 56 copy stream files parameter, DSREPAIR options for, 186 cpinterval=<number of seconds> parameter, relationship to checkpoints, 258 CPUs, considering number and speed of, 5 current_log field in DTD, description of, 91 D -d <ext> DSREPAIR option on NetWare/ Windows, description of, 190 -D switch, using with ICE, 222 *d# DSTRACE trigger, description of, 215 DA (Directory Agent), role in server-toserver communication, 6 DAS (Direct Attached Storage) systems, relationship to disk I/O, 257 data, bulk-loading with ICE, 129 data loss, preventing, database cache. See FLAIM cache dead obituaries, description of, 172 Default Referral option, using with LDAP server option, See also referrals designate new master parameter, DSREPAIR options for, 194

11 288 INDEX destroy selected replica parameter, DSREPAIR options for, dhost, relationship to memory assignments, 250 dhost threads, evaluating in Windows, 238 DIB backup, implementing through DSREPAIR, 82, 86 DIB size, relationship to backup and restore strategy, DIBClone features of, 88, replicating servers with, 84 DIBMIG process, location of results of, 51 DIBs migrating from NDS 6.x or 7.x to edirectory 8.5, migrating to edirectory 8.7.3, 53 role in NetWare migration with Migration Wizard, 44 role in troubleshooting NetWare installations, 17 dirty cache, definition of, 258 DirXML external modules, monitoring with DSTRACE, 214 disable reference checks parameter, DSREPAIR options for, 185 disable replica ring check parameter, DSREPAIR options for, 186 disable schema flag repair parameter, DSREPAIR options for, 189 disable the check attributes parameter, DSREPAIR options for, 194 disaster recovery of NetWare installations, 16 of *nix operating-system installations, of Windows installations, 18 disk I/O and checkpoint threads, 258 and DAS (Direct Attached Storage) systems, 257 and disk cache, 257 disk space requirements, accessing documentation about, 14 Distributed References operation in DSTRACE, monitoring, DNs (Distinguished Names) finding with imonitor, 231 relationship to LDAP binds, 113 relationship to Unknown objects, 158 DNS operation in DSTRACE, monitoring, 207 -dr -a DSREPAIR option on NetWare/ Windows, description of, 190 DRL Detail operation in DSTRACE, monitoring, 207 DRL process, high processor utilization by, 179 DSLOADER.NLM, role in migration to edirectory 8.7.3, 53 DSMERGE tool and NetWare, 77 and *nix operating systems, 78 overview of, and Windows, 77 DSREPAIR command-line utility accessing from NetWare, 182 accessing from Windows, 183 addressing volume errors in after migration, advisory about, 182 command-line options for, DIB backup feature of, 82 features of, 182 large-scale considerations for, launching, 182 making schema identical in trees with, 75 performing DIB backups with, 86 relationship to partition splits, 66 using with failed Move SubTree operations, 75 using with failed partition splits, 67 using with partition merges, 69 DSREPAIR menu wrapper, downloading, 183 dsrepair rc, recovering edirectory database with, 52 DSRepair>Repair server addresses option, potential failure of, 10 DSTRACE command-line utility availability of, 140, 148 changing default edirectory settings with, determining connection server with, 244 executing triggers in, finding connection problems with, 230 forcing schema synchronization from, 103 monitoring external modules with, 214 overview of, 198 relationship to indexes, 252

12 INDEX 289 starting in Windows, 200 tracking bindery issues with, troubleshooting imonitor with, 158 troubleshooting modules with, 228 troubleshooting schema synchronization issues with, 233 using on *nix operating systems, using with failed Move SubTree operations, using with failed partition merges, 71 using with failed partition splits, 67 using with imonitor, using with LDAP queries, 118 viewing schema status with, DSTRACE commands, overview of, DSTRACE logs, capturing, DSTRACE messages, viewing, 200 DSTRACE operations, monitoring, DSTRACE.NLM module, features of, dsversion field in DTD, description of, 91 DTDs (Document Type Definitions), data stored in, dynamic mode options for FLAIM cache, configuring in imonitor, 247 E -E DSREPAIR option on *nix, description of, 197!e#* DSTRACE commands, settings edirectory accessing documentation for, 4 accessing information about installation of, 3 applying patches to, 4 determining current executions by, 178 hardware considerations related to, 4 5 impact on high processor utilization, logging into, mixed-environment considerations for migration, monitoring with NDS imonitor, operating systems supported by, 4 processor time taken up by, 178 protocol considerations related to, removing after failed installation, 16 security considerations related to, troubleshooting with NDSLogin, unloading, 226 upgrading to minimize memory fragmentation, 239 edirectory 8.7.3, migrating DIB from, 53 edirectory 8.5, 8.6, or 8.7, migrating DIB from, 53 edirectory x, migrating edirectory database to, edirectory 8.7.x administration options for, installing on existing trees, 35 migrating to, 40 updating program files to, edirectory Administration Guide, 3 edirectory Administration role, using with imanager, 136 edirectory agent relationship to subordinate references, 70 role in partition merges, 68 treatment of partition flags and attributes, 64 edirectory bottlenecks, troubleshooting, edirectory database migrating to edirectory x, recovering with dsrepair rc, 52 unlocking, 45 edirectory instance, configuring with ndsconfig, 10 edirectory Maintenance role, using with imanager, 136 edirectory settings, changing defaults for, EDIRUTIL command-line utility, features of, edirutil.exe, location on Windows, 94 eguide, disallowing anonymous binds with, 129 embox tool allowing roll-forward logging with, features of, 85, launching with EDIRUTIL,

13 290 INDEX using with imanager for backups, website for, 80 Emulated Bindery operation in DSTRACE, monitoring, 207 EntryID of edirectory objects managing during migrations, 46 treatment by legacy file systems, 35 36, 54 environment variables, getting and setting with NDSConfig, Error 2, occurrence of, 98 Error Index view in imonitor, features of, 142, 149 errors occurrence in NICI, 268 schema violations, 159 /etc/hosts.nds, finding tree names with, 8 Ethereal LAN-tracing application, obtaining, 244 event information, location in LDAP server objects, 122 exclamation mark (!), changing edirectory default settings with, expressions showing with LDAP filters, 115 using with FLAIM database, 116 external modules, monitoring with DSTRACE, 214 F -F <log filename> DSREPAIR option on *nix, description of, 190 *f DSTRACE trigger, description of, 215!f# DSTRACE command, setting failed logins, occurrence of, 258 Failed to obtain a Novell edirectory Server Connection error message, appearance of, 220 fault cache measurements in imonitor, descriptions of, 249 file copy option, restoring files with, file systems, relationship to backup and restore strategy, 88 file_* fields in DTD, descriptions of, 92 Filter by Health option, comparing schemas with, , filters. See LDAP filters fix schema syntax parameter, DSREPAIR options for, flag Unknown objects as reference parameter, DSREPAIR options for, 193 FLAIM cache configuring dynamic settings for, configuring static cache settings for, decreasing, 239 high memory consumption by, 237 optimal settings for, 248 FLAIM database, relationship to performance of LDAP queries, 116 forced checkpoint, definition of, 258 Fragmented Requests operation in DSTRACE, monitoring, 207 Full Compare option, comparing schemas with, , 168 functions, troubleshooting in processor high utilization, G *g DSTRACE trigger, description of, 215 -g parameter, using with EDIRUTIL, 222 generate a new key pair parameter, DSREPAIR options for, 191 get function, using with LDAPConfig, 219 -gkp -rd -a DSREPAIR option on NetWare/Windows, description of, 191 group objects. See LDAP group objects Groups role in imanager, features of, 133 GUID (Globally Unique Identifier), treatment of, 36, 54 H!h# DSTRACE command, setting *h* DSTRACE triggers, descriptions of, 215 hardware, considering, 4 5 high utilization. See processor high utilization hosts.nds file, relationship to tree merges on *nix systems, 76 hot continuous backups backup file header in, for DIBs, implementation of, 85

14 INDEX 291 for multiple servers, 89 overview of, performing with Backup emtool, preventing data loss with, 86 resource for, 87 and roll-forward logging, HP-UX systems. See *nix operating systems HTML traces, maintaining with imonitor, HTTP ports, determining for imonitor, HTTP server objects, 152 modifying through imanager, modifying through LDAP, 156 modifying through ndsconfig, 153 modifying through NetWare, HTTP stack module accessing configuration page for, 157 monitoring with DSTRACE, 214 viewing status of, 150, 151 HTTP stack port, determining for imonitor, 138 HTTPSTK in NetWare, significance of, I *i DSTRACE trigger, description of, 215 -i parameter, using with EDIRUTIL, 222!i# DSTRACE command, setting ICE (Import Convert Export) commandline utility accessing, 108 bulk-loading data with, 129 dumping RootDSE for LDAP server extensions with, 126 extending schemas with, features of, resource for, 129 using with LDAP server objects, idtag field in DTD, description of, 91 ignore API versions parameter, DSREPAIR options for, 195 imanager certificate access in, 134 configuring and performing embox backups with, disallowing anonymous binds with, 129 downloading, 131 extending objects with, 109 extending schemas with, 108 Groups role in, 133 HTTP object attributes in, large-scale considerations for, 265 modifying HTTP server objects with, 153 Novell Certificate Server feature of, 134 Novell Certificate Server role in, 134 overview of, partition and replica management in, 134 Passwords in, 135 re-creating LDAP objects with, 124 repairing replicas with, 264 repairing single objects with, 263 roles and tasks in, using Time Synchronization plug-in with, 136 View Objects View in, 137 viewing LDAP server extensions with, 125 imanager 2.0.x installation, requirements for, 27 imanager 2.5 configuring Persistent Search with, 121 creating indexes in, 119 imanager administrative tool, features of, imanager roles. See roles in imanager imonitor accessing, 146 Agent Activity view in, , 149, Agent Configuration page in, 140, 147, Agent Health view in, 141, 148 Agent Process Status screen in, 141 Agent Process Status view in, 149 Agent Summary view in, 139, 146 Agent Synchronization feature of, 139 Agent Synchronization view in, 146 cache measurements in, capturing DSTRACE messages from, comparing schemas with, configuring dynamic mode options for FLAIM cache with, 247 Connections view in, 142, 149 controlling schema synchronization with,

15 292 INDEX determining HTTP ports for, disabling synchronization with, 231 Error Index view in, 142, 149 finding synchronization errors with, 232 getting connection information with, 230 identifying obituaries with, initiating DIBClone process with, 261 Known Servers view in, 139, 147 large-scale considerations for, listing Unknown objects with, overview of, 138 remedying schema issues with, resolving obituary issues with, Schema Compare feature in, 168 Schema view in, 140, 147 Trace Configuration page in, , 148 Trace option in, 179 troubleshooting with DSTRACE, 158 turning on Advanced Mode in, 165 using DSTRACE with, viewing schema list in, 103 viewing Schema partition object in, 102 viewing schema status with, imonitor modules loading, 151 monitoring with DSTRACE, 214 viewing status of, 151 imonitor pages, accessing with SADMIN account, 157 imonitor process, overview of, imonitor treewide health check performing for partition merges, 68 performing for partition splits, 65 Inbound Synchronization operation in DSTRACE, monitoring, 208 incremental_file_id field in DTD, description of, 92 indexes creating in imanager 2.5, 119 impact on performance of LDAP queries, role in LDAP, types of, inhibit move obituaries, description of, 172 Initialization operation in DSTRACE, monitoring, 208 -ins DSREPAIR option on NetWare/ Windows, description of, 191 Inspector operation in DSTRACE, monitoring, 208 installation failures, troubleshooting for NetWare, interfaces, disabling from advertising, 243 I/O channels, considering, 5 IP, NetWare s support for, 58 IP-based platforms, advisory about upgrading to, 59 IPX (Internetwork Packet Exchange) protocol NetWare s support for, 58 significance of, 25, 26 J -J DSREPAIR option on *nix, description of, 195 *j DSTRACE trigger, description of, 215!j# DSTRACE command, setting Janitor operation in DSTRACE, monitoring, 208 K KMO objects in Security Infrastructure, binaries for and usage of, Known Servers view in imonitor, features of, 139, 147 L -l <log filename> DSREPAIR option on NetWare/Windows, description of, 191 -l > <file> ndstrce command, description of, 202 *l* DSTRACE triggers, descriptions of, 215 LAN-tracing applications, obtaining, 244 large-scale considerations DIBClone, disk I/O, DSREPAIR, FLAIM cache, LDAP (Lightweight Directory Access Protocol), management utilities, memory management, processors,

16 INDEX 293 LDAP (Lightweight Directory Access Protocol) and access control, and indexes, modifying HTTP server objects with, 156 overview of, 112 and Persistent Search, 121 and tree design, LDAP binds, information required for, 112 LDAP extensions, relationship to LDAP objects, 125 LDAP filters, overview of, LDAP group objects, configuring for proxy users, 129 LDAP objects adding extension information to, 127 creating and configuring, group objects, server objects, LDAP operation in DSTRACE, monitoring, 208 LDAP ports, relationship to LDAP binds, 113 LDAP queries. See also anonymous LDAP queries and bases, 115 impact of indexing on, impact of partitioning on, 120 impact of schema syntax on, 120 impact of search order on, and LDAP filters, measuring performance of, 120 performance considerations related to, and scope, 115 using DSTRACE with, 118 using Predicate Stats with, 118 LDAP request time out, default setting for, 258 LDAP requests, high processor utilization by, 179 LDAP role in imanager, features of, 133 LDAP search algorithm, changes in, 255 LDAP search requests, parts of, 254 LDAP server objects re-creating, 125 using Default Referral option with, using LDIF files with, 126 LDAP servers, configuring for anonymous binds, 128 LDAP Stack operation in DSTRACE, monitoring, 208 ldap_simple_bind failed: 13(Confidentiality required) error, occurrence of, 107 LDAPConfig command-line utility, features of, ldapconfig utility, re-creating LDAP objects with, 124 LDIF files adding schema classes with, 107 deleting schemas with, 107 format of, 106 modifying existing schemas with, using ICE with, 129, 222 using with auxiliary classes, 109 using with LDAP objects, 126 leaf objects in source [Root] partition, role in tree merges, 76 Limber operation in DSTRACE, monitoring, 208 Linux systems. See also *nix operating systems advisor about IPX-only servers with, 26 migrating to edirectory 8.7.x, support for time synchronization, 26 troubleshooting high memory consumption on, Locking operation in DSTRACE, monitoring, 209 logins, troubleshooting slow logins, Lost Entry operation in DSTRACE, monitoring, 209 lowdirtycache=<minimum number of bytes of dirty cache> parameter, relationship to checkpoints, 258 LWP (Light Weight Process) threads, high memory consumption by, 238 M -m -rd -a DSREPAIR option on NetWare/ Windows, description of, 191 *m# DSTRACE trigger, description of, 215 management utilities, large-scale considerations for, mandatory attributes, verifying missing status of,

17 294 INDEX manual mode, performing NetWare upgrades in, 47 master of [Root], role in tree merges, 76 maxdirtycache=<maximum number of bytes of dirty cache> parameter, relationship to checkpoints, 258 memory considering, 5 considering amounts of, memory consumption, troubleshooting, memory fragmentation issues, identifying and minimizing, 239 memory management, large-scale considerations for, Microsoft Windows. See Windows migration methods in-place upgrade of NetWare, Migration Wizard for NetWare, provision of, 40 SCU (Server Consolidation Utility) for NetWare, for Solaris and Linux systems, for Windows, 49 Migration Wizard, using with NetWare, migrations, undoing after failure with Migration Wizard, 45 Miscellaneous Distributed Operations in DSTRACE, monitoring, 209 missing mandatory objects, resolving, 164 modification_time field in DTD, description of, 92 modify schema syntax parameter, DSREPAIR options for, 185 modules high memory consumption by, 239 troubleshooting with DSTRACE, 228 unloading, 227 Move Object operation in DSTRACE, monitoring, 209 Move SubTree operations best practices for, overview of, troubleshooting failure of, moved obituaries, description of, 172 Moved tree/moved from obituaries, description of, 172 multiple instance feature, benefits of, 274 N -N DSREPAIR option on *nix, description of, 194 NCP, disabling on TIMESYNC.NLM, 12 NCP Client operation in DSTRACE, monitoring, 209 NCP Engine operation in DSTRACE, monitoring, 210 NCP server object role in best practices for partition merges, 70 role in Move SubTree operations, 74 NDS 6.x or 7.x, migrating DIB from, NDS 8, migrating DIB from, 53 NDS and edirectory patch levels, overview of, NDS imonitor. See imonitor NDS versions, checking trees for, 54 NDSBackup command-line utility features of, 82 83, 86 using with DIBs, using with multiple servers, 89 ndsconfig add option, potential failure of, 10 NDSConfig command-line utility accessing help page for, 218 configuring edirectory instance with, 10 features of, modifying HTTP server objects with, 153 re-creating LDAP objects with, 124 NDSCONS, launching, 150, 200 NDSD, relationship to memory assignments, 250 NDSD LWP threads, evaluating in *nix, 238 ndsd/dhost process space, modules running in, 227 NDSLogin command-line utility, features of, NDSSch command-line utility features of, 221 resource for, 108 NDSStat command-line utility, features of, 220 ndsstat -s option, potential failure of, 10 ndstrace command syntaxes, descriptions of, netstat, syntax for, 152

18 INDEX 295 NetWare accessing DSREPAIR from, 182 configuration of, creating NICI files on, 269 determining HTTP ports for, 151 determining port for HTTP stack in, 138 disabling interface advertisement on, 243 disaster recovery steps for, 16 and DSMERGE tool, 77 DSREPAIR command-line options for, evaluating service process threads in, 238 file copy process of, finding PKI version on, 34 HTTP stack and imonitor module commands for, 150 making configuration changes to, 15 memory management in, 250 minimizing NSS cache on, 239 modifying HTTP server objects in, netstat syntax for, 152 performing in-place upgrades of, and server-to-server communication, 6 7 support for IP and IPX, 58 troubleshooting edirectory with, troubleshooting high memory consumption in, troubleshooting tips for installation of, 16 upgrading from edirectory to edirectory 8.7.x, upgrading with Migration Wizard, upgrading with SCU (Server Consolidation Utility), using DSTRACE logs with, 22 NetWare Client 32 for Windows 4.9.x, disallowing anonymous binds with, 129 NetWare clustering products, problems associated with, 54 NetWare documentation website, 47 NetWare overlay CDs, accessing, 41 network issues, eliminating to troubleshoot slow logins, new/def operation, performing with NDSConfig, 218 next_inc_file_id field in DTD, description of, 92 NFAP (Native File Access Protocol), storage of secrets in, 27 NICI files creating on NetWare, 269 deleting when corrupted, 269 NICI keys creating, upgrading, 50 NICI security, troubleshooting, NICI versions, relationship to Security Infrastructure, 33 *nix operating systems. See also Linux systems; Solaris systems accessing DSREPAIR from, 183 configuration of, creating NICI files on, 270 determining HTTP ports for, 151 determining port for HTTP stack in, 138 disabling interface advertisement on, 244 and DSMERGE tool, 78 DSREPAIR command-line options for, evaluating NDSD LWP threads in, 238 explanation of, 7 10, 40 file copy process of, 19 finding PKI version on, 35 HTTP stack and imonitor module commands for, 150 ldapconfig utility in, 125 memory management in, 250 ndsindex utility in, 120 netstat syntax for, 152 protocol considerations related to, 58 requirements for tree merges on, 76 troubleshooting high memory consumption on, 237 troubleshooting installation of, 20 using DSTRACE logs with, 23 using DSTRACE on, using DSTRACE to monitor external modules for, 214 using NDS Backup with, using NDSStat on, 220 using ndstrace module on,

19 296 INDEX NMAS Administration Guide, website for, 134 NMAS errors, resolving with tree keys, 274 NMAS external module, monitoring with DSTRACE, 214 NMAS method object in Security Infrastructure, binaries for and usage of, 32 NMAS role in imanager, features of, Novell Certificate Server role, features of, 134 Novell Client32, configuring SLP for, 7 Novell edirectory. See edirectory Novell edirectory Administration Guide website, 3 Novell products, life cycle of, 57 Novell Security Infrastructure, overview of, Novell s documentation website, 41 Novell s Knowledgebase, accessing, 229 NPS (Novell Portal Services) website, 135 NRM (Novell Remote Manager), troubleshooting high memory consumption with, NSS 3.0, advantages of, 54 NSS cache, minimizing on NetWare, 239 NTP, relationship to time synchronization, 11 NTP daemon, implementation of, 12 number_of_files field in DTD, description of, 91 NWAdmin tool, features of, 56 NWCONFIG, directory backup and restore options in, 81 nwconfig dsremvoe, running, 16 O *o* <EntryID> DSTRACE triggers, descriptions of, 215 obituaries identifying with imonitor, overview of, processing, Obituaries operation in DSTRACE, monitoring, 210 obituary issues, resolving with imonitor, object deletion, obituary process for, Object Producers operation in DSTRACE, monitoring, 210 Object Statistics reports, running in imonitor, 160 Object version obituaries, description of, 173 objectclass=*, advisory about, 117 objects. See also Unknown objects; valid objects and DNs (fully qualified distinguished names), 158 extending with imanager, 109 repairing with imanager, 263 objects and services, creation during configuration stage, OES (Open Enterprise Server) features of, 58 IPX/TCP communication issues related to, 26 offline mode, performing NetWare upgrades in, 47 OIDs, using with LDAP server objects, 126 Old RDN/New RDN obituaries, description of, 172 one versus sub scope, relationship to LDAP queries, 117 online mode, performing NetWare upgrades in, 47 OpenSLP, finding tree names with, 9 operating systems, support for, 4 operations, delays in, 258 OR ed expressions, impact on performance of LDAP queries, 116 Organization (o) object, requirements for tree merges, 76 os field in DTD, description of, 91 Outbound Sync Detail operation in DSTRACE, monitoring, 210 Outbound Synchronization operation in DSTRACE, monitoring, 210 P -P DSREPAIR option on *nix, description of, 190, 194 *p DSTRACE trigger, description of, 216 parent partition, definition of, 64 partition, definition of, 64 partition boundary, definition of, 64 partition ID, changing with edirectory agent, 65

20 INDEX 297 partition merges best practices for, overview of, 68 troubleshooting failure of, Partition operation in DSTRACE, monitoring, 210 partition operations delays in, 258 executing in imanager, 134 partition replication implementation of, 85 preventing data loss with, 86 partition root objects, extension by edirectory agent, 64 partition splits best practices for, overview of, troubleshooting failure of, 67 partitioning impact on performance of LDAP queries, 120 relationship to backup and restore strategy, 88 partitions displaying in imonitor, 139 moving, partition-specific attributes for partition merges, 68 for partition splits, 65 passwords, relationship to LDAP binds, 113 Passwords role in imanager, features of, 135 patches applying, 4 applying for NDS and edirectory, upgrading to, performance of LDAP queries, measuring for LDAP queries, Persistent Search, relationship to LDAP, 121 pipe ( ) symbol using with FLAIM database, 116 using with LDAP filters, 115 PKI external modules, monitoring with DSTRACE, 214 PKI versions finding, 34 relationship to Security Infrastructure, 33 ports, determining for HTTP stack and imonitor, 138, 151 Predicate Stats relationship to indexes, using with LDAP queries, 118 presence indexes using, 254 using with LDAP queries, 119 processes, identifying in high memory consumption, processor high utilization causing with bindery issues, causing with looping requests on connections, causing with offending functions, causing with schema synchronization, 233 causing with synchronization, detecting offending processes in, noticing trends related to, troubleshooting, , troubleshooting with Agent Activity screen, processors number of, speed of, 256 program files upgrading for NetWare, upgrading for Windows, 49 protocols considering, considering for multiple platforms, 58 proxy users, configuring LDAP group objects for, 129 Purge operation in DSTRACE, monitoring, 211 purge the Backlink attribute parameter, DSREPAIR options for, 197 purge trustees parameter, DSREPAIR options for, 196 Q QoS (Quality of Service) mask, using with bindery issues, 229

21 298 INDEX R -r DSREPAIR options on NetWare/ Windows, descriptions of, *r DSTRACE trigger, description of, 216 -r switch, using with NDSStat, 220 -R* -DSREPAIR options on *nix, descriptions of, , RAID versus SCSI, 257 RBS (Role-Based Services) configuring in imanager, 133 relationship to EMBox, 94 resource for, 133 read/write replicas, changing to masters, 71. See also replicas +recm DSTRACE filter, using with LDAP queries, 118 reference checks, disabling with imanager, 263 Referral Options, using with LDAP server option, 128 referrals. See also Conditions to Use Default Referral option; Default Referral option in LDAP group objects, 123 in LDAP server objects, 123 remove all partitions parameter, DSREPAIR options for, 196 remove bindery type 258 parameter, DSREPAIR options for, 197 remove NLS certificate values parameter, DSREPAIR options for, 192 repair default ACLs parameter, DSREPAIR options for, 187 Repair external modules, monitoring with DSTRACE, 214 repair known servers to the database parameter, DSREPAIR options for, 194 repair replica ring parameter, DSREPAIR options for, 194 repair server addresses parameter, DSREPAIR options for, 194 repair volume objects and trustees parameter, DSREPAIR options for, 194 repair volume objects parameter, DSREPAIR options for, 188, 194 replica rings, problems associated with, 67 replica_partition_dn field in DTD, description of, 92 replica_state field in DTD, description of, 92 replica_type field in DTD, description of, 92 replicas. See also read/write replicas addition by edirectory agent, 65 definition of, 64 locating valid objects in, relationship to subordinate references, 70 repairing with imanager, 264 replication, Web resource for, 89 report replica synchronization parameter, DSREPAIR options for, 197 reports move inhibit obituaries parameter, DSREPAIR options for, 191 Request Schema option in imonitor, description of, 170 reset all external references parameter, DSREPAIR options for, 196 reset local schema parameter, DSREPAIR options for, 195 reset log files parameter, DSREPAIR options for, 194 Reset Schema option in imonitor, description of, 170 Resolve Name operation in DSTRACE, monitoring, 211 resources. See also websites for ICE, 129 NMAS Administration Guide, 134 for obituaries, 174 for SNMP (Simple Network Management Protocol), 142 restore strategies. See backup and restore strategies Restored obituaries, description of, 172 RFLs (roll-forward logs) and hot continuous backups, 94 storage of directory modifications in, 91 rights, setting up in imanager, 133 rkuser, relationship to auxiliary classes, 109 rm operation, performing with NDSConfig, 218 roles in imanager edirectory Administration role, 136 edirectory Maintenance role, 136

22 INDEX 299 Groups role, 133 LDAP role, 133 NMAS (Novell Modular Authentication Services) role, Novell Certificate Server role, 134 Partition and Replica management role, 134 Passwords role, 135 Rights role in, 135 Users role, 136 roll-forward logging and hot continuous backups, relationship to Backup emtool, resource for, 86 [Root] master, role in tree merges, 76 [Root] partition servers, significance of, RootDSE record, viewing LDAP server extensions with, 126 run a local repair and lock the database parameter, DSREPAIR options for, 194 run a local repair parameter, DSREPAIR options for, 193 S -S -Ad DSREPAIR option on *nix, description of, 195 -s DSREPAIR options on NetWare/Windows, descriptions of, S switch, using with ICE, 222 -s switch, using with NDSStat, 220!s#* DSTRACE commands, settings *s* DSTRACE triggers, descriptions of, 216 SADMIN account, accessing imonitor pages with, 157 SAP (Service Advertising Protocol), significance of, 6 SAP operation in DSTRACE, monitoring, 211 SAS objects in Security Infrastructure, binaries for and usage of, 30 scan all objects during reference check parameter, DSREPAIR options for, 186 SCH files processing with NDSSch, 221 significance of, 108 schema making identical in trees for tree merges, 75 relationship to Unknown objects, 36 schema classes adding through LDIF, 107 relationship to auxiliary classes, 36 Schema Compare feature in imonitor, accessing, 168 Schema Detail operation in DSTRACE, monitoring, 212 Schema Epoch option in imonitor, description of, 170, 171 schema extension explanation of, 105 with ICE (Import Convert Export) Utility, with imanager, 108 schema issues, remedying with imonitor, schema list, viewing in NDS imonitor, 103 Schema operation in DSTRACE, monitoring, 211 Schema partition object, viewing in NDS imonitor, 102 schema poll list building, 100 definition of, 99 schema synchronization causing processor high utilization with, 233 controlling, monitoring, overview of, schema syntax, impact on performance of LDAP queries, 120 Schema view in imonitor, features of, 140, 147 schema violations, errors related to, 159 schemas comparing, deleting through LDIF files, 107 determining validity of, 169 dumping to files, 107 modifying, resetting, 171 troubleshooting, SCMD (Server Compatibility Mode), significance of, 26