From 54a91c3ed33c7be54cadb188add802e781893ec9 Mon Sep 17 00:00:00 2001 From: Martin Basti Date: Mon, 18 Jan 2016 17:19:08 +0100 Subject: [PATCH] Exclude o=ipaca subtree from Retro Changelog (syncrepl) CA and DS have issues with Retro Changelog plugin. CA subtree should be excluded from syncrepl. This should improve speed of CA related operations too. https://fedorahosted.org/freeipa/ticket/5538 Reviewed-By: Christian Heimes --- install/updates/20-syncrepl.update | 1 + 1 file changed, 1 insertion(+) diff --git a/install/updates/20-syncrepl.update b/install/updates/20-syncrepl.update index d2937d636..8b02133f5 100644 --- a/install/updates/20-syncrepl.update +++ b/install/updates/20-syncrepl.update @@ -4,6 +4,7 @@ only:nsslapd-pluginEnabled: on # Remember original nsuniqueid for objects referenced from cn=changelog add:nsslapd-attribute: nsuniqueid:targetUniqueId add:nsslapd-changelogmaxage: 2d +add:nsslapd-exclude-suffix: o=ipaca # Keep memberOf and referential integrity plugins away from cn=changelog. # It is necessary for performance reasons because we don't have appropriate