The PingDirectory Server uses indexes to improve database search performance and provide consistent search rates regardless of the number of database objects stored in the Directory Information Tree (DIT).

  • To search for how indexes are used in a search operation, you can either:
    • Issue a search request with the desired base distinguished name (DN), scope, and filter, and request that the server return the special debugsearchindex attribute using the ldapsearch command.
      $ bin/ldapsearch --hostname ds.example.com \
       --port 389 --bindDN uid=admin,dc=example,dc=com \
       --bindPassword password \
       --baseDN dc=example,dc=com \
       --searchScope sub "(&(givenName=John)(sn=Doe))" debugsearchindex
       dn: cn=debugsearch
       debugsearchindex: 0.040 ms - Beginning index processing for search
           request with base DN 'dc=example,dc=com', scope wholeSubtree,
           and filter (&(givenName=John)(sn=Doe)).
       debugsearchindex: 0.067 ms - Unable to optimize the AND filter
           beyond what the client already provided.
       debugsearchindex: 0.834 ms - Candidate set obtained for single-key
           filter (givenName=John) from index dc_example_dc_com_givenName.equality.
           Candidate set:  CandidateSet(isDefined=true, isExploded=false,
           isResolved=true, size=2, originalFilter=(givenName=John),
           remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT)
       debugsearchindex: 0.030 ms - Final candidate set for filter (givenName=John)
           obtained from an unexploded index key in dc_example_dc_com_givenName.equality.
           Since the scope of the search includes the entire entry container, there is
           no need to attempt to further pare down the results based on the search scope.
           Candidate set:  CandidateSet(isDefined=true, isExploded=false, isResolved=true,
           size=2, originalFilter=(givenName=John), remainingFilter=null,
           matchingEntryCountType=UNEXAMINED_COUNT)
       debugsearchindex: 0.020 ms - Short-circuiting index processing for AND filter
           (&(givenName=John)(sn=Doe)) after evaluating single-key component
           (givenName=John) because the current ID set size of 2 is within the
            short-circuit threshold of 5.
       debugsearchindex: 0.030 ms - Obtained a candidate set of size 2 for AND filter
           (&(givenName=John)(sn=Doe)) with remaining filter (sn=Doe).  Even though
           there is still more of the filter to evaluate, the current candidate set is
           within the short-circuit threshold of 5, so no additional index processing will
           be performed to try to pare down the results based on the remaining filter or the
           search scope.  Candidate set:  CandidateSet(isDefined=true, isExploded=false,
           isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)),
           remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND)
       debugsearchindex: 0.016 ms - Completed all index processing.  Candidate set:
           CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2,
           originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe),
           matchingEntryCountType=UPPER_BOUND)
      Note:

      Users must have access to the debugsearchindex operational attribute and the cn=debugsearch portion of the DIT with the following command.

      $ bin/dsconfig set-access-control-handler-prop \
       --add "global-aci:(targetattr=\"debugsearchindex\")(target=\"ldap:///cn=debugsearch\")
          (version 3.0; acl \"Allow members of the Index Debugging Users group
          to request the debugsearchindex operational attribute \"; allow
          (read,search,compare) groupdn=\"ldap:///cn=Index Debugging
          Users,ou=Groups,dc=example,dc=com\";)"
    • Issue a search request with the desired base DN, scope, and filter, and include the matching entry count request control with the debug option set to true using ldapsearch.
      $ bin/ldapsearch --hostname ds.example.com --port 389 \
       --bindDN uid=admin,dc=example,dc=com --bindPassword password \
       --baseDN dc=example,dc=com \
       --searchScope sub --matchingEntryCountControl examineCount=0:debug "(&(givenName=John)(sn=Doe))"
       Upper Bound on Matching Entry Count:  2
       Matching Entry Count Debug Messages:
       * naw-desktop:1389 - 0.104 ms - Beginning index processing for search request with
          base DN 'dc=example,dc=com', scope wholeSubtree, and filter (&(givenName=John)(sn=Doe)).
       * naw-desktop:1389 - 0.105 ms - Unable to optimize the AND filter beyond what the client already provided.
       * naw-desktop:1389 - 0.614 ms - Candidate set obtained for single-key filter (givenName=John) from index
          dc_example_dc_com_givenName.equality.  Candidate set:
          CandidateSet(isDefined=true, isExploded=false, isResolved=true,
          size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT)
       * naw-desktop:1389 - 0.090 ms - Final candidate set for filter
          (givenName=John) obtained from an unexploded index key in
          dc_example_dc_com_givenName.equality.  Since the scope of the search
          includes the entire entry container, there is no need
          to attempt to further pare down the results based on the search scope.
          Candidate set:  CandidateSet(isDefined=true, isExploded=false, isResolved=true,
          size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT)
       * naw-desktop:1389 - 0.045 ms - Short-circuiting index processing for AND filter
          (&(givenName=John)(sn=Doe)) after evaluating single-key component
          (givenName=John) because the current ID set size of 2 is within the short-circuit threshold of 5.
       * naw-desktop:1389 - 0.111 ms - Obtained a candidate set of size 2 for AND filter
          (&(givenName=John)(sn=Doe)) with remaining filter (sn=Doe).  Even though there is
          still more of the filter to evaluate, the current candidate set is within
          the short-circuit threshold of 5, so no additional index processing will be performed
          to try to pare down the results based on the remaining filter or the search scope.
          Candidate set:  CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2,
          originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe),
          matchingEntryCountType=UPPER_BOUND)
       * naw-desktop:1389 - 0.040 ms - Completed all index processing.  Candidate set:
          CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2,
          originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe),
          matchingEntryCountType=UPPER_BOUND)
       * naw-desktop:1389 - The search is partially indexed (candidatesAreInScope=true,
          unindexedFilterPortion=(sn=Doe))
       * naw-desktop:1389 - Constructing an UPPER_BOUND response with a count of 2