The PingDirectory server uses indexes to improve database search performance and provide consistent search rates regardless of the number of database objects stored in the Directory Information Tree (DIT).
To search for how indexes are used in a search operation, you can either:
- Issue a search request with the desired base distinguished name (DN),
scope, and filter, and request that the server return the special
debugsearchindex attribute using the
ldapsearch
command.
$ bin/ldapsearch --hostname ds.example.com \ --port 389 --bindDN uid=admin,dc=example,dc=com \ --bindPassword password \ --baseDN dc=example,dc=com \ --searchScope sub "(&(givenName=John)(sn=Doe))" debugsearchindex dn: cn=debugsearch debugsearchindex: 0.040 ms - Beginning index processing for search request with base DN 'dc=example,dc=com', scope wholeSubtree, and filter (&(givenName=John)(sn=Doe)). debugsearchindex: 0.067 ms - Unable to optimize the AND filter beyond what the client already provided. debugsearchindex: 0.834 ms - Candidate set obtained for single-key filter (givenName=John) from index dc_example_dc_com_givenName.equality. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) debugsearchindex: 0.030 ms - Final candidate set for filter (givenName=John) obtained from an unexploded index key in dc_example_dc_com_givenName.equality. Since the scope of the search includes the entire entry container, there is no need to attempt to further pare down the results based on the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) debugsearchindex: 0.020 ms - Short-circuiting index processing for AND filter (&(givenName=John)(sn=Doe)) after evaluating single-key component (givenName=John) because the current ID set size of 2 is within the short-circuit threshold of 5. debugsearchindex: 0.030 ms - Obtained a candidate set of size 2 for AND filter (&(givenName=John)(sn=Doe)) with remaining filter (sn=Doe). Even though there is still more of the filter to evaluate, the current candidate set is within the short-circuit threshold of 5, so no additional index processing will be performed to try to pare down the results based on the remaining filter or the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND) debugsearchindex: 0.016 ms - Completed all index processing. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND)Note:Users must have access to the debugsearchindex operational attribute and the cn=debugsearch portion of the DIT with the following command.
$ bin/dsconfig set-access-control-handler-prop \ --add "global-aci:(targetattr=\"debugsearchindex\")(target=\"ldap:///cn=debugsearch\") (version 3.0; acl \"Allow members of the Index Debugging Users group to request the debugsearchindex operational attribute \"; allow (read,search,compare) groupdn=\"ldap:///cn=Index Debugging Users,ou=Groups,dc=example,dc=com\";)" - Issue a search request with the desired base DN, scope, and filter, and
include the matching entry count request control with the debug option set
to true using
ldapsearch.
$ bin/ldapsearch --hostname ds.example.com --port 389 \ --bindDN uid=admin,dc=example,dc=com --bindPassword password \ --baseDN dc=example,dc=com \ --searchScope sub --matchingEntryCountControl examineCount=0:debug "(&(givenName=John)(sn=Doe))" Upper Bound on Matching Entry Count: 2 Matching Entry Count Debug Messages: * naw-desktop:1389 - 0.104 ms - Beginning index processing for search request with base DN 'dc=example,dc=com', scope wholeSubtree, and filter (&(givenName=John)(sn=Doe)). * naw-desktop:1389 - 0.105 ms - Unable to optimize the AND filter beyond what the client already provided. * naw-desktop:1389 - 0.614 ms - Candidate set obtained for single-key filter (givenName=John) from index dc_example_dc_com_givenName.equality. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) * naw-desktop:1389 - 0.090 ms - Final candidate set for filter (givenName=John) obtained from an unexploded index key in dc_example_dc_com_givenName.equality. Since the scope of the search includes the entire entry container, there is no need to attempt to further pare down the results based on the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(givenName=John), remainingFilter=null, matchingEntryCountType=UNEXAMINED_COUNT) * naw-desktop:1389 - 0.045 ms - Short-circuiting index processing for AND filter (&(givenName=John)(sn=Doe)) after evaluating single-key component (givenName=John) because the current ID set size of 2 is within the short-circuit threshold of 5. * naw-desktop:1389 - 0.111 ms - Obtained a candidate set of size 2 for AND filter (&(givenName=John)(sn=Doe)) with remaining filter (sn=Doe). Even though there is still more of the filter to evaluate, the current candidate set is within the short-circuit threshold of 5, so no additional index processing will be performed to try to pare down the results based on the remaining filter or the search scope. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND) * naw-desktop:1389 - 0.040 ms - Completed all index processing. Candidate set: CandidateSet(isDefined=true, isExploded=false, isResolved=true, size=2, originalFilter=(&(givenName=John)(sn=Doe)), remainingFilter=(sn=Doe), matchingEntryCountType=UPPER_BOUND) * naw-desktop:1389 - The search is partially indexed (candidatesAreInScope=true, unindexedFilterPortion=(sn=Doe)) * naw-desktop:1389 - Constructing an UPPER_BOUND response with a count of 2