Need Help with "ldap_search: Administrative limit exceeded" issue

Question

Hi,
I recently created an index for an attribute called abcSmDisableFlag. When i perform an Ldapsearch using an application owners binddn, 10 entires are returned before i get the error: ldap_search: Administrative limit exceeded. When I use the Directory Manager I do not get this error while the same 10 entries are returned.
I have analyzed the error and access logs and i think the problem is with the index (notes=U). I performed a reindex on the attribute but it din't work.
Below are the details i gathered from
error log:
[20/Sep/2010:15:04:59 -0400] - WARNING<20805> - Backend Database - conn=1189378 op=1 msgId=2 - search is not indexed base='ou=customers,o=abc
enterprises,c=us,dc=abc,dc=net' filter='(&(objectClass=abcIdentity)(abcIdmDeleteDate<=2010-09-20)(!(abcSmDisabledFlag=1)))' scope='sub'
access log:
[20/Sep/2010:15:04:59 -0400] conn=1189378 op=-1 msgId=-1 - fd=536 slot=536 LDAP connection from UserIP to ServerIP
[20/Sep/2010:15:04:59 -0400] conn=1189378 op=0 msgId=1 - BIND dn="cn=xyzservices,ou=appid,dc=abc,dc=net" method=128 version=3
[20/Sep/2010:15:04:59 -0400] conn=1189378 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0.001190 dn="cn=xyzservices,ou=appid,dc=abc,dc=net"
[20/Sep/2010:15:04:59 -0400] conn=1189378 op=1 msgId=2 - SRCH base="ou=customers,o=abc enterprises,c=us,dc=abc,dc=net" scope=2 filter="(&
(objectClass=abcIdentity)(abcIdmDeleteDate<=2010-09-20)(!(abcSmDisabledFlag=1)))" attrs=ALL
[20/Sep/2010:15:05:03 -0400] conn=1189378 op=1 msgId=2 - RESULT err=11 tag=101 nentries=1 etime=4.604440 notes=U
I have indexed both abcIdmDeleteDate and abcSmDisabledFlag with a presence and equality index.
I am using Sun Directory Server 6.2. All the nsslapd limits are at Default value and I am not supposed to increase those values.
I will be very grateful if anyone can kindly share ideas/solutions on this issue and help me out.
Thanks!!

Answer 1

I don't know if your issue has been resolved but two things i see here:
1 - you should not be on 6.2, move to 6.3 or 7.
2 - your filter is the answer, when you use a filter of "(&(objectclass=abcIdentity)(abcIdmDeleteDate<=2010-09-16)("\!"(abcSmDisabledFlag=1)))", DSEE takes the 1st part of your filter, in your case objectclass=abcIdentity, and does a search on it. Then after retrieving all entries it checks all that have an abcSmDisableFlag <=2010-09-16 and finally out of the remaining entries it will check which do not have an abcSmDisableFlag=1.
The search on objectClass is resulting in an unindexed search, apparently. What you need to do is alter the order of your attributes in your search filter and have objectClass at the end.
I hope this makes sense and helps.