Page created: 4 Feb 2020
|
Page updated: 22 Jul 2020
The PingDirectory Server uses indexes to improve database search performance and provide consistent search rates regardless of the number of database objects stored in the Directory Information Tree (DIT). Information about the can be obtained about the server's use of indexes in the course of processing a search operation. The following are two basic ways to accomplish this.
Issue a search request with the desired base DN, scope, and filter, and request that the
server return the special debugsearchindex attribute. Users will need
to be granted access to the debugsearchindex operational attribute
and the cn=debugsearch portion of the DIT with the following command:
$ bin/dsconfig set-access-control-handler-prop \ --add "global-aci:(targetattr=\"debugsearchindex\")(target=\"ldap:///cn=debugsearch\") (version 3.0; acl \"Allow members of the Index Debugging Users group to request the debugsearchindex operational attribute \"; allow (read,search,compare) groupdn=\"ldap:///cn=Index Debugging Users,ou=Groups,dc=example,dc=com\";)"
To issue a search request for the server return the special
debugsearchindex attribute, use
the ldapsearch command such as:
$ bin/ldapsearch --hostname ds.example.com \ --port 389 --bindDN uid=admin,dc=example,dc=com \ --bindPassword password \ --baseDN dc=example,dc=com \ --searchScope sub "(&(givenName=John)(sn=Doe))" debugsearchindex dn: cn=debugsearch debugsearchindex: 0.040 ms - Beginning index processing for search request with base DN 'dc=example,dc=com', scope wholeSubtree, and filter (&(givenName=John)(sn=Doe)). debugsearchindex: 0.067 ms - Unable to optimize the AND filter beyond what the client already provided. debugsearchindex: 0.834 ms - Candidate set obtained for single-key filter (givenName=John) from index dc_example_dc_com_givenName.equality. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) debugsearchindex: 0.030 ms - Final candidate set for filter (givenName=John) obtained from an unexploded index key in dc_example_dc_com_givenName.equality. Since the scope of the search includes the entire entry container, there is no need to attempt to further pare down the results based on the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) debugsearchindex: 0.020 ms - Short-circuiting index processing for AND filter (&(givenName=John)(sn=Doe)) after evaluating single-key component (givenName=John) because the current ID set size of 2 is within the short-circuit threshold of 5. debugsearchindex: 0.030 ms - Obtained a candidate set of size 2 for AND filter (&(givenName=John)(sn=Doe)) with remaining filter (sn=Doe). Even though there is still more of the filter to evaluate, the current candidate set is within the short-circuit threshold of 5, so no additional index processing will be performed to try to pare down the results based on the remaining filter or the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND) debugsearchindex: 0.016 ms - Completed all index processing. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND)
The second way would be to issue a search request with the desired base DN,
scope, and filter, and include the matching entry count request control
with the debug option set to true. To do this with
ldapsearch, use a command such as:
$ bin/ldapsearch --hostname ds.example.com --port 389 \ --bindDN uid=admin,dc=example,dc=com --bindPassword password \ --baseDN dc=example,dc=com \ --searchScope sub --matchingEntryCountControl examineCount=0:debug "(&(givenName=John)(sn=Doe))" Upper Bound on Matching Entry Count: 2 Matching Entry Count Debug Messages: * naw-desktop:1389 - 0.104 ms - Beginning index processing for search request with base DN 'dc=example,dc=com', scope wholeSubtree, and filter (&(givenName=John)(sn=Doe)). * naw-desktop:1389 - 0.105 ms - Unable to optimize the AND filter beyond what the client already provided. * naw-desktop:1389 - 0.614 ms - Candidate set obtained for single-key filter (givenName=John) from index dc_example_dc_com_givenName.equality. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) * naw-desktop:1389 - 0.090 ms - Final candidate set for filter (givenName=John) obtained from an unexploded index key in dc_example_dc_com_givenName.equality. Since the scope of the search includes the entire entry container, there is no need to attempt to further pare down the results based on the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) * naw-desktop:1389 - 0.045 ms - Short-circuiting index processing for AND filter (&(givenName=John)(sn=Doe)) after evaluating single-key component (givenName=John) because the current ID set size of 2 is within the short-circuit threshold of 5. * naw-desktop:1389 - 0.111 ms - Obtained a candidate set of size 2 for AND filter (&(givenName=John)(sn=Doe)) with remaining filter (sn=Doe). Even though there is still more of the filter to evaluate, the current candidate set is within the short-circuit threshold of 5, so no additional index processing will be performed to try to pare down the results based on the remaining filter or the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND) * naw-desktop:1389 - 0.040 ms - Completed all index processing. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND) * naw-desktop:1389 - The search is partially indexed (candidatesAreInScope=true, unindexedFilterPortion=(sn=Doe)) * naw-desktop:1389 - Constructing an UPPER_BOUND response with a count of 2