Using slapcat to backup LDAP

Question

I'm running an OpenLDAP directory on a Debian server, using the hdb backend. I've been wondering about backups, and did som reading on the net. Slapcat seems to be the way to go, but I keep seeing these posts speaking about it being dangerous to use it while slapd is running.

In what way is this dangerous? I'm planning to run these backups during the night, and no writing will be done to the database during the night - reads will probably occur though.

If there's any other backup solution better suited for this, I'd gladly hear about it.

Answer 1

OpenLDAP supports various backends, the most popular currently being bdb/hdb. From the slapcat manpage:

   For some backend types, your slapd(8) should not be running (at  least,
   not  in  read-write mode) when you do this to ensure consistency of the
   database. It is always safe  to  run  slapcat  with  the  slapd-bdb(5),
   slapd-hdb(5), and slapd-null(5) backends.

So, so long as you're using bdb or hdb as a backend, no problem running it while slapd is running. I use this on many servers, and recommend it. It is really the best way to backup.

Alternatives would include issuing a ldap search command to the server to return the whole tree. This will be significantly slower than slapcat, because all communication must go through the network layers, and access control rules must be checked. Also, you have to be very sure that the user you're searching as has the correct access rights.

Answer 2

The reason slapcat is dangerous is because it pokes around in the database directly. Depending on the database format, this can cause file corruption, or deadlocks.

Here's what I do:

1. Set up replication between two openldap installs
2. Periodically shut down slapd on the slave, copy the database files out, then start it back up

That's it. I run both copies of openldap on the same machine (different ports, replication is bound only to 127.0.0.1 so it doesn't leak out onto the actual ethernet).

Answer 3

If you're willing to recreate your LDAP directory using the bdb backend, that might be the way to go. At my site we've been running a slapcat backup on a live directory with ~10k entries every 4 hours for the last six years or so, and haven't had a single problem with it.