freeipa

#8542 ipa-backup stores 389-DS data three times
Opened by cheimes. Modified

Open
Close Issue

Issue

A backup with ipa-backup contains 389-DS data three times

  1. db2ldif LDIF export of ipaca and useRroot in REALM-NAME-ipaca.ldif and REALM-NAME-userRoot.ldif
  2. db2bak BDB backup of changelog, ipaca, and userRoot in REALM-NAME directory
  3. a second copy of BDB files in files.tar:var/lib/dirsrv/slapd-REALM-NAME/

Copies 2 and 3 are almost identical:

# diff -qr IPA-EXAMPLE/ var/lib/dirsrv/slapd-IPA-EXAMPLE/db/
Only in var/lib/dirsrv/slapd-IPA-EXAMPLE/db/: __db.001
Only in var/lib/dirsrv/slapd-IPA-EXAMPLE/db/: __db.002
Only in var/lib/dirsrv/slapd-IPA-EXAMPLE/db/: __db.003
Only in IPA-EXAMPLE/: dse_index.ldif
Only in IPA-EXAMPLE/: dse_instance.ldif
Only in var/lib/dirsrv/slapd-IPA-EXAMPLE/db/: guardian

I think the directory /var/lib/dirsrv/ can be safely excluded, which should reduce the total file size of a backup considerable.

Version/Release/Distribution

freeipa-server-4.8.9-2.fc32.x86_64
freeipa-client-4.8.9-2.fc32.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-1.4.3.12-1.fc32.x86_64
pki-ca-10.9.4-1.fc32.noarch
krb5-server-1.18.2-22.fc32.x86_64

Viktor said that __db.00[123] are DB environment files. They are not necessary for 389-DS and can be safely deleted/ignored.

One more observation: ipa-restore does not use the db2bak BDB backup. The restore class has a function to deal with BDB backups, but Restore.bak2db is never called. Restore uses slower LDIF import to restore a DS from scratch.

What is the point of a BDB backup when it's never used? Why does restore not use the faster approach?

BDB restore is faster and more efficient than an LDIF import. Amongst others it is not necessary to rebuild indices. Index rebuild is a time and resource consuming task when the system has a non-trivial amount of data.

However BDB restore is problematic when the target system has a different 389-DS or libdb version. I assume that 389-DS can upgrade databases to a more recent version but downgrades may not work.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.