Patch attached
From cffdb8b4cc7af8edc1500069a375d62530b309fe Mon Sep 17 00:00:00 2001
From: Martin Basti <>
Date: Mon, 18 Jan 2016 17:19:08 +0100
Subject: [PATCH] Exclude o=ipaca subtree from Retro Changelog (syncrepl)

CA and DS have issues with Retro Changelog plugin. CA subtree should be
excluded from syncrepl.
This should improve speed of CA related operations too.
 install/updates/20-syncrepl.update | 1 +
 1 file changed, 1 insertion(+)

diff --git a/install/updates/20-syncrepl.update b/install/updates/20-syncrepl.update
index d2937d636209e15678f791ca807bdabe3cb01b0d..8b02133f5a755d599915d76682cf9fe6e3565768 100644
--- a/install/updates/20-syncrepl.update
+++ b/install/updates/20-syncrepl.update
@@ -4,6 +4,7 @@ only:nsslapd-pluginEnabled: on
 # Remember original nsuniqueid for objects referenced from cn=changelog
 add:nsslapd-attribute: nsuniqueid:targetUniqueId
 add:nsslapd-changelogmaxage: 2d
+add:nsslapd-exclude-suffix: o=ipaca
 # Keep memberOf and referential integrity plugins away from cn=changelog.
 # It is necessary for performance reasons because we don't have appropriate

Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA:

Reply via email to