I have OpenLDAP version 2.4.40 which is being cross compiled for a different (proprietary) target. This has been in place and working fine for many years but now I find myself needing to get some debugging from OpenLDAP to troubleshoot a memory leak which could potentially be in the OpenLDAP library itself.

I have searched high & low about how to get debugging from OpenLDAP logged into a file but every single thing I have found is always talking about SLAPD. We do not use SLAPD at all - it is not even compiled in. E.g., --disable-slapd is specified in the Makefile after running configure.

So even though I've tried things I have found related to getting debug information, none of it has worked and I'm guessing that is because what I have found is SLAPD specific.

I also have '--enable-debug=yes' configured.

NOTE also that we don't use the standard syslogd on the Linux target but rather a similar one called uxlogd which is pretty much our own as we have unique requirements not supported by syslogd.

Obviously I am not going to ask here any questions which is specific to our proprietary uxlogd but I would appreciate assistance on how to get debugging working solely from an OpenLDAP perspective. Since everything I have found is related to SLAPD I suspect I am not doing something correctly in configuring OpenLDAP conf files.

I am guessing I need to configure something in /etc/openldap/ldap.conf but I'm not sure what.

Any help is much appreciated.

Thanks Allen


Shared libraries don't typically produce their own debug output by default - the programs that link them are supposed to take care of that, because they may use various ways to communicate to the user: the console, some sort of X output, syslog, ...

Did you try calling ldap_set_option(..., LDAP_OPT_DEBUG_LEVEL, LDAP_DEBUG_TRACE) from the program you link to the OpenLDAP library?

Per ldap.conf(5), there's no 1:1 mapping between those options and all the library options, and DEBUG_LEVEL isn't explicitly mentioned as available.

  • Hi Josip, Thanks. I done more digging today in the OpenLDAP source and it seems that only the SLAPD component properly supports debugging. – Allen McWongahey Jun 28 '16 at 4:09
  • 1
    Hi Josip, Sorry about the short comment. The editor here is quite limited. In short I've got this working after digging into the OpenLDAP source deeper and had to make some changes to get this working. It seems after code inspection that only the SLAPD component properly supports writing to a log file. Note that ber_set_option can be called to send in a log filename via LBER_OPT_LOG_PRINT_FILE. This is called outside of connection context since all connections should write to the same file. Let me know if you want more detail on this. Thanks Allen – Allen McWongahey Jun 28 '16 at 4:18
  • @AllenMcWongahey I see the lutil_debug_file(logfile) stuff in the source, but the default Debug defines always call both the lutil_debug() facility as well as syslog(). So as long as your syslog implementation actually handles the syslog(3) semantics properly, you should be good to go there. I'm not sure why you'd want to depend on an arbitrary logfile writer if you've already got that. – Josip Rodin Jun 28 '16 at 15:29
  • 1
    Hi Josip, The Debug macro has 2 different definitions. I suspect SLAPD uses the one referenced in ldap_log.h but the one used for non SLAPD or at least what I need uses the Debug macro def defined in ldap-int.h which in turn calls ldap_log_printf located in 'libraries/libldap/print.c'. In turn this calls 'ber_pvt_log_print' located in 'libraries/liblber/bprint.c'. The ldap_set_option for debug level also does not work because although it is stored, the LDAP pointer is not passed to the underlying routines that actually writes the message out. – Allen McWongahey Jun 28 '16 at 22:55
  • While I could have spent more time trying to add in the proper support I needed to get this working quickly. When I look at all the bugs opened against the slapd component it is actually no surprise to me that the developers extended more effort getting this working for that module. :) The first definition I noticed was the one you mentioned in ldap_log.h but it pretty quickly became obvious that those functions were never getting called for the areas I needed to get debug out of. :( Thanks – Allen McWongahey Jun 28 '16 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.