19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:T71a,

 1	root@xxxxxxx:/# ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=module{0},cn=config"
 2	SASL/EXTERNAL authentication started
 3	SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
 4	SASL SSF: 0
 5	# extended LDIF
 6	#
 7	# LDAPv3
 8	# base <cn=module{0},cn=config> with scope subtree
 9	# filter: (objectclass=*)
10	# requesting: ALL
11	#
12
13	# module{0}, config
14	dn: cn=module{0},cn=config
15	objectClass: olcModuleList
16	cn: module{0}
17	olcModulePath: /usr/lib/ldap
18	olcModuleLoad: {0}back_mdb
19	olcModuleLoad: {1}memberof
20	olcModuleLoad: {2}refint
21
22	# search result
23	search: 2
24	result: 0 Success
25
26	# numResponses: 2
27	# numEntries: 1
28	root@9e93cb7f031d:/# ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
29	> dn: cn=module{0},cn=config
30	> changetype: modify
31	> add: olcModuleLoad
32	> olcModuleLoad: back_monitor
33	> EOF
34	SASL/EXTERNAL authentication started
35	SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
36	SASL SSF: 0
37	modifying entry "cn=module{0},cn=config"
38
39	root@9e93cb7f031d:/# ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=module{0},cn=config"
40	SASL/EXTERNAL authentication started
41	SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
42	SASL SSF: 0
43	# extended LDIF
44	#
45	# LDAPv3
46	# base <cn=module{0},cn=config> with scope subtree
47	# filter: (objectclass=*)
48	# requesting: ALL
49	#
50
51	# module{0}, config
52	dn: cn=module{0},cn=config
53	objectClass: olcModuleList
54	cn: module{0}
55	olcModulePath: /usr/lib/ldap
56	olcModuleLoad: {0}back_mdb
57	olcModuleLoad: {1}memberof
58	olcModuleLoad: {2}refint
59	olcModuleLoad: {3}back_monitor
60
61	# search result
62	search: 2
63	result: 0 Success
64
65	# numResponses: 2
66	# numEntries: 1

1b:T6d7,1 root@xxxxxxx:/# ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=module{0},cn=config" 2 SASL/EXTERNAL authentication started 3 SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth 4 SASL SSF: 0 5 # extended LDIF 6 # 7 # LDAPv3 8 # base with scope subtree 9 # filter: (objectclass=*) 10 # requesting: ALL 11 # 12 13 # module{0}, config 14 dn: cn=module{0},cn=config 15 objectClass: olcModuleList 16 cn: module{0} 17 olcModulePath: /usr/lib/ldap 18 olcModuleLoad: {0}back_mdb 19 olcModuleLoad: {1}memberof 20 olcModuleLoad: {2}refint 21 22 # search result 23 search: 2 24 result: 0 Success 25 26 # numResponses: 2 27 # numEntries: 1 28 root@9e93cb7f031d:/# ldapmodify -Y EXTERNAL -H ldapi:/// < dn: cn=module{0},cn=config 30 > changetype: modify 31 > add: olcModuleLoad 32 > olcModuleLoad: back_monitor 33 > EOF 34 SASL/EXTERNAL authentication started 35 SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth 36 SASL SSF: 0 37 modifying entry "cn=module{0},cn=config" 38 39 root@9e93cb7f031d:/# ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=module{0},cn=config" 40 SASL/EXTERNAL authentication started 41 SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth 42 SASL SSF: 0 43 # extended LDIF 44 # 45 # LDAPv3 46 # base with scope subtree 47 # filter: (objectclass=*) 48 # requesting: ALL 49 # 50 51 # module{0}, config 52 dn: cn=module{0},cn=config 53 objectClass: olcModuleList 54 cn: module{0} 55 olcModulePath: /usr/lib/ldap 56 olcModuleLoad: {0}back_mdb 57 olcModuleLoad: {1}memberof 58 olcModuleLoad: {2}refint 59 olcModuleLoad: {3}back_monitor 60 61 # search result 62 search: 2 63 result: 0 Success 64 65 # numResponses: 2 66 # numEntries: 11c:T4cd,

 1
 2import ldap
 3import time
 4
 5def main():
 6    connections = []
 7    target_connection_count = 1023
 8    try:
 9        while len(connections) < target_connection_count:
10            try:
11                # 尝试连接到 localhost:389 上的 openldap 服务
12                conn = ldap.initialize("ldap://localhost:389")
13                conn.simple_bind_s("cn=admin,dc=example,dc=org", "admin")  # 请使用有效的管理员 DN 和密码
14                connections.append(conn)
15                result = conn.search_s("dc=example,dc=org", ldap.SCOPE_SUBTREE)
16                print(result)
17                time.sleep(0.5)
18            except ldap.LDAPError as e:
19                print(f"LDAP error occurred: {e}")
20                break
21        while True:
22            # 保持程序运行，以保持占用文件描述符
23            pass
24    except Exception as e:
25        print(f"An error occurred: {e}")
26    finally:
27        # 关闭所有创建的 LDAP 连接
28        for conn in connections:
29            try:
30                conn.unbind()
31            except ldap.LDAPError:
32                pass
33
34
35if __name__ == "__main__":
36    main()

11:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/0fdcf1f2b5c68a0f","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","mephisto.cc"]}],["$","span",null,{"children":"工程"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","mephisto.cc"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2025年2月4日",null]}]]}],["$","$L19",null,{"article":{"title":"OpenLDAP监控","byline":null,"publishedAt":"2025-02-04T00:00:00.000Z","language":"en","blocks":[{"id":"b0","type":"paragraph","html":"

OpenLDAP 是一款开源的轻型目录访问协议（Lightweight Directory Access Protocol，LDAP）服务器软件。提供了一个可定制、可扩展的目录服务，用于存储和管理各种类型的信息，如用户账户、组织结构、配置信息等，这些信息以树形结构进行组织和存储，方便快速查询和检索。\n许多企业将 OpenLDAP 用于集中管理用户账户和权限，用户在访问公司的各种系统和资源时，可以通过 OpenLDAP 进行统一的身份认证和授权，如登录企业邮箱、VPN、Gitlab、Jenkins等。\n当然也可以家用，比如说现在过年人多，你可以弄个Linux虚拟机跑OpenLDAP，让NAS接入，好像也有点用。

","text":"OpenLDAP 是一款开源的轻型目录访问协议（Lightweight Directory Access Protocol，LDAP）服务器软件。提供了一个可定制、可扩展的目录服务，用于存储和管理各种类型的信息，如用户账户、组织结构、配置信息等，这些信息以树形结构进行组织和存储，方便快速查询和检索。许多企业将 OpenLDAP 用于集中管理用户账户和权限，用户在访问公司的各种系统和资源时，可以通过 OpenLDAP 进行统一的身份认证和授权，如登录企业邮箱、VPN、Gitlab、Jenkins等。当然也可以家用，比如说现在过年人多，你可以弄个Linux虚拟机跑OpenLDAP，让NAS接入，好像也有点用。"},{"id":"b1","type":"paragraph","html":"

本文不讲OpenLDAP本身的部署维护，因为相关资料很多了，内容主要为如何接入OpenLDAP监控。

","text":"本文不讲OpenLDAP本身的部署维护，因为相关资料很多了，内容主要为如何接入OpenLDAP监控。"},{"id":"b2","type":"paragraph","html":"

事情的背景时这样的，我年中的时候入职了个初创公司，前阵子突然看到技术群里面有人反馈，OpenLDAP无法登录，会影响业务。情况紧急相关同事快速重启OpenLDAP容器服务解决了问题。这种状况在小公司很常见，可能原来没什么服务接入，或者维护这个的人员早就提桶跑路了，或者没什么外部影响，重启还真的可能是最快速有效的解决方式😂。

","text":"事情的背景时这样的，我年中的时候入职了个初创公司，前阵子突然看到技术群里面有人反馈，OpenLDAP无法登录，会影响业务。情况紧急相关同事快速重启OpenLDAP容器服务解决了问题。这种状况在小公司很常见，可能原来没什么服务接入，或者维护这个的人员早就提桶跑路了，或者没什么外部影响，重启还真的可能是最快速有效的解决方式😂。"},{"id":"b3","type":"paragraph","html":"

当天早上盲猜问题就是FD默认配置1024不够了，维护的服务够多的话，这种情况还是有不少的，历史原因导致，无可非议，也许当场只有5个人使用，公司只打算开2年关门呢？

","text":"当天早上盲猜问题就是FD默认配置1024不够了，维护的服务够多的话，这种情况还是有不少的，历史原因导致，无可非议，也许当场只有5个人使用，公司只打算开2年关门呢？"},{"id":"b4","type":"paragraph","html":"

人和程序有一个能跑就行，恰巧你到的时候，不能跑又想高枕无忧，怎么办呢？接入监控吧。Google里面输入OpenLDAP监控，中文有效资料少得可怜，又到了填补空白的时候了。

","text":"人和程序有一个能跑就行，恰巧你到的时候，不能跑又想高枕无忧，怎么办呢？接入监控吧。Google里面输入OpenLDAP监控，中文有效资料少得可怜，又到了填补空白的时候了。"},{"id":"b5","type":"paragraph","html":"

监控系统现在选Prometheus很常见，功能易用，社区活跃，个人觉得比好多年前省事多了。

","text":"监控系统现在选Prometheus很常见，功能易用，社区活跃，个人觉得比好多年前省事多了。"},{"id":"b6","type":"paragraph","html":"

直白点，方案选用的Prometheus + openldap_exporter[https://github.com/tomcz/openldap_exporter]。可惜的是这个仓库作者也归档不维护了，不过能用，有能力的Fork自己玩吧。

","text":"直白点，方案选用的Prometheus + openldap_exporter[https://github.com/tomcz/openldap_exporter]。可惜的是这个仓库作者也归档不维护了，不过能用，有能力的Fork自己玩吧。"},{"id":"b7","type":"paragraph","html":"

由于原来的OpenlLDAP是采用容器化方式部署的，接入监控有点麻烦，也是难点所在。容器仓库为：https://github.com/osixia/docker-openldap

","text":"由于原来的OpenlLDAP是采用容器化方式部署的，接入监控有点麻烦，也是难点所在。容器仓库为：https://github.com/osixia/docker-openldap"},{"id":"b8","type":"heading","html":"

1. 如何接入监控

","text":"1. 如何接入监控"},{"id":"b9","type":"paragraph","html":"

建议自己线找个测试环境测试，进入容器后。

","text":"建议自己线找个测试环境测试，进入容器后。"},{"id":"b10","type":"list","html":"

载入监控模块模块

","text":"载入监控模块模块"},{"id":"b11","type":"paragraph","html":"$1a","text":"$1b"},{"id":"b12","type":"paragraph","html":"

上面操作过程输出确认，监控模块已载入

","text":"上面操作过程输出确认，监控模块已载入"},{"id":"b13","type":"list","html":"

添加监控用户

","text":"添加监控用户"},{"id":"b14","type":"paragraph","html":"

密码部分我用xxx代替了，操作示例：

","text":"密码部分我用xxx代替了，操作示例："},{"id":"b15","type":"paragraph","html":"

 1\troot@4433d2af4a1d:/# slappasswd -s your_password\n 2\t{SSHA}xxx\n 3\n 4\tldapadd -Y EXTERNAL -H ldapi:/// <<EOF\n 5\tdn: cn=monitor,dc=example,dc=org\n 6\tobjectClass: simpleSecurityObject\n 7\tobjectClass: organizationalRole\n 8\tcn: monitor\n 9\tdescription: LDAP monitor\n10\tuserPassword: {SSHA}xxx\n11\tEOF\n

","text":"1 root@4433d2af4a1d:/# slappasswd -s your_password 2 {SSHA}xxx 3 4 ldapadd -Y EXTERNAL -H ldapi:/// <第一次显示没有权限，-w admin意为使用管理原权限写入

","text":"第一次显示没有权限，-w admin意为使用管理原权限写入"},{"id":"b17","type":"paragraph","html":"

 1\troot@9e93cb7f031d:/# ldapadd -Y EXTERNAL -H ldapi:/// <<EOF\n 2\t> dn: cn=monitor,dc=example,dc=org\n 3\t> objectClass: simpleSecurityObject\n 4\t> objectClass: organizationalRole\n 5\t> cn: monitor\n 6\t> description: LDAP monitor\n 7\t> userPassword: {SSHA}3W8Q0HWiBVRyy2qX47qPVZQxQvZ3/R9+\n 8\t> EOF\n 9\tSASL/EXTERNAL authentication started\n10\tSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n11\tSASL SSF: 0\n12\tadding new entry \"cn=monitor,dc=example,dc=org\"\n13\tldap_add: Insufficient access (50)\n14\t        additional info: no write access to parent\n15\n16\troot@9e93cb7f031d:/# ldapadd -x -D cn=admin,dc=example,dc=org -w 'admin' <<EOF\n17\t> dn: cn=monitor,dc=example,dc=org\n18\t> objectClass: simpleSecurityObject\n19\t> objectClass: organizationalRole\n20\t> cn: monitor\n21\t> description: LDAP monitor\n22\t> userPassword: {SSHA}xxx\n23\t> EOF\n24\tadding new entry \"cn=monitor,dc=example,dc=org\"\n

","text":"1 root@9e93cb7f031d:/# ldapadd -Y EXTERNAL -H ldapi:/// < dn: cn=monitor,dc=example,dc=org 3 > objectClass: simpleSecurityObject 4 > objectClass: organizationalRole 5 > cn: monitor 6 > description: LDAP monitor 7 > userPassword: {SSHA}3W8Q0HWiBVRyy2qX47qPVZQxQvZ3/R9+ 8 > EOF 9 SASL/EXTERNAL authentication started 10 SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth 11 SASL SSF: 0 12 adding new entry \"cn=monitor,dc=example,dc=org\" 13 ldap_add: Insufficient access (50) 14 additional info: no write access to parent 15 16 root@9e93cb7f031d:/# ldapadd -x -D cn=admin,dc=example,dc=org -w 'admin' < dn: cn=monitor,dc=example,dc=org 18 > objectClass: simpleSecurityObject 19 > objectClass: organizationalRole 20 > cn: monitor 21 > description: LDAP monitor 22 > userPassword: {SSHA}xxx 23 > EOF 24 adding new entry \"cn=monitor,dc=example,dc=org\""},{"id":"b18","type":"list","html":"

验证新添加用户读取信息是否正常

","text":"验证新添加用户读取信息是否正常"},{"id":"b19","type":"paragraph","html":"

1\troot@9e93cb7f031d:/# ldapwhoami -x -D \"cn=monitor,dc=example,dc=org\" -w \"your_password\"\n2\tdn:cn=monitor,dc=example,dc=org\n

","text":"1 root@9e93cb7f031d:/# ldapwhoami -x -D \"cn=monitor,dc=example,dc=org\" -w \"your_password\" 2 dn:cn=monitor,dc=example,dc=org"},{"id":"b20","type":"paragraph","html":"

如上所示，查询到了结果，表明用户信息正常，密码填你上面设置的。

","text":"如上所示，查询到了结果，表明用户信息正常，密码填你上面设置的。"},{"id":"b21","type":"list","html":"

添加监控数据库

","text":"添加监控数据库"},{"id":"b22","type":"paragraph","html":"

1ldapadd -Y EXTERNAL -H ldapi:/// <<EOF\n2dn: olcDatabase={2}Monitor,cn=config\n3objectClass: olcDatabaseConfig\n4objectClass: olcMonitorConfig\n5olcDatabase: {2}Monitor\n6olcAccess: {0}to dn.subtree=\"cn=Monitor\" by dn.base=\"cn=monitor,dc=example,dc=org\" read by * none\n7EOF\n

","text":"1ldapadd -Y EXTERNAL -H ldapi:/// <如果数据库是存在的：

","text":"如果数据库是存在的："},{"id":"b24","type":"paragraph","html":"

1ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF\n2dn: olcDatabase={2}Monitor,cn=config\n3changetype: modify\n4replace: olcAccess\n5olcAccess: {0}to dn.subtree=\"cn=Monitor\" by dn.base=\"cn=monitor,dc=example,dc=org\" read by * none\n6EOF\n

","text":"1ldapmodify -Y EXTERNAL -H ldapi:/// <

 1\troot@9e93cb7f031d:/# ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF\n 2\tdn: olcDatabase=Monitor,cn=config\n 3\tchangetype: modify\n 4\treplace: olcAccess\n 5\tolcAccess: {0}to dn.subtree=\"cn=Monitor\" by dn.base=\"cn=monitor,dc=example,dc=org\" read by * none\n 6\tEOF\n 7\tSASL/EXTERNAL authentication started\n 8\tSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n 9\tSASL SSF: 0\n10\tmodifying entry \"olcDatabase=Monitor,cn=config\"\n11\tldap_modify: No such object (32)\n12\t        matched DN: cn=config\n

","text":"1 root@9e93cb7f031d:/# ldapmodify -Y EXTERNAL -H ldapi:/// <上面显示不存在数据库时的报错，没有数据库直接修改肯定不行啦（存在：ldapmodify，不存在：ldapadd，合理没毛病）

","text":"上面显示不存在数据库时的报错，没有数据库直接修改肯定不行啦（存在：ldapmodify，不存在：ldapadd，合理没毛病）"},{"id":"b27","type":"paragraph","html":"

看起来很简单是不是，倘若第一次接触理解，上面的语句什么意思都要理解半天，我就是看了很久官方文档 + AI辅助 + 动手实践。

","text":"看起来很简单是不是，倘若第一次接触理解，上面的语句什么意思都要理解半天，我就是看了很久官方文档 + AI辅助 + 动手实践。"},{"id":"b28","type":"heading","html":"

2. 部署监控组件openldap_exporter

","text":"2. 部署监控组件openldap_exporter"},{"id":"b29","type":"paragraph","html":"

上述不是有个监控模块吗？怎么这里又有个监控组件。不一样，上面的是服务端，这个是客户端，用来读取上面监控模块的信息，再吐给Prometheus的，大概是这样的链路：

","text":"上述不是有个监控模块吗？怎么这里又有个监控组件。不一样，上面的是服务端，这个是客户端，用来读取上面监控模块的信息，再吐给Prometheus的，大概是这样的链路："},{"id":"b30","type":"paragraph","html":"

Prometheus <--- openldap_exporter监控组件 <--- OpenLDAP server的监控模块

","text":"Prometheus <--- openldap_exporter监控组件 <--- OpenLDAP server的监控模块"},{"id":"b31","type":"paragraph","html":"

这部分很简单没什么好说的。看操作：

","text":"这部分很简单没什么好说的。看操作："},{"id":"b32","type":"paragraph","html":"

 1    xxx@xxx: cat /etc/systemd/system/openldap_exporter.service\n 2    [Unit]\n 3    Description=OpenLDAP Exporter\n 4    After=network.target\n 5\n 6    [Service]\n 7    Type=simple\n 8    ExecStart=/opt/openldap_exporter/openldap_exporter --promAddr \":8080\" --interval \"10s\" --config /opt/openldap_exporter/config.yml\n 9    Restart=on-failure\n10\n11    [Install]\n12    WantedBy=multi-user.target\n13\n14    xxx@xxx:~$ cat /opt/openldap_exporter/config.yml\n15    ---\n16    ldapUser: \"cn=monitor,dc=example,dc=org\"\n17    ldapPass: \"your_password\"\n

","text":"1 xxx@xxx: cat /etc/systemd/system/openldap_exporter.service 2 [Unit] 3 Description=OpenLDAP Exporter 4 After=network.target 5 6 [Service] 7 Type=simple 8 ExecStart=/opt/openldap_exporter/openldap_exporter --promAddr \":8080\" --interval \"10s\" --config /opt/openldap_exporter/config.yml 9 Restart=on-failure 10 11 [Install] 12 WantedBy=multi-user.target 13 14 xxx@xxx:~$ cat /opt/openldap_exporter/config.yml 15 --- 16 ldapUser: \"cn=monitor,dc=example,dc=org\" 17 ldapPass: \"your_password\""},{"id":"b33","type":"paragraph","html":"

如果监控组件没有正确显示指标，就要耐心慢慢排查，先确认服务端没有问题，再查看服务端日志，甚至要读监控组件的源码，别问，我就是这样过来的。读者比我幸运，没有中文用户在我之前写这些，反正没搜到。

","text":"如果监控组件没有正确显示指标，就要耐心慢慢排查，先确认服务端没有问题，再查看服务端日志，甚至要读监控组件的源码，别问，我就是这样过来的。读者比我幸运，没有中文用户在我之前写这些，反正没搜到。"},{"id":"b34","type":"heading","html":"

3. 接入Prometheus

","text":"3. 接入Prometheus"},{"id":"b35","type":"paragraph","html":"

简单示例如下：

","text":"简单示例如下："},{"id":"b36","type":"paragraph","html":"

1  - job_name: \"openldap\"\n2    static_configs:\n3      - targets: [\"10.10.20.98:8080\"]\n

","text":"1 - job_name: \"openldap\" 2 static_configs: 3 - targets: [\"10.10.20.98:8080\"]"},{"id":"b37","type":"paragraph","html":"

懒得截图了。

","text":"懒得截图了。"},{"id":"b38","type":"heading","html":"

4. 接入Grafana

","text":"4. 接入Grafana"},{"id":"b39","type":"paragraph","html":"

监控面板还是很有用的，领导上级都很喜欢，你应该懂的。

","text":"监控面板还是很有用的，领导上级都很喜欢，你应该懂的。"},{"id":"b40","type":"paragraph","html":"

很遗憾，目前社区没什么制作好的面板，我自己动手制作了一个。要的话，可以关注我微信公众号，我发给你，真关注真发。

","text":"很遗憾，目前社区没什么制作好的面板，我自己动手制作了一个。要的话，可以关注我微信公众号，我发给你，真关注真发。"},{"id":"b41","type":"paragraph","html":"

示例图片见下面的压测。

","text":"示例图片见下面的压测。"},{"id":"b42","type":"heading","html":"

5. 压测

","text":"5. 压测"},{"id":"b43","type":"paragraph","html":"

上文提到初步判断的是FD数目没配置导致的问题，需要压测验证。

","text":"上文提到初步判断的是FD数目没配置导致的问题，需要压测验证。"},{"id":"b44","type":"paragraph","html":"

压测程序放出来：

","text":"压测程序放出来："},{"id":"b45","type":"paragraph","html":"$1c","text":"1 2import ldap 3import time 4 5def main(): 6 connections = [] 7 target_connection_count = 1023 8 try: 9 while len(connections) < target_connection_count: 10 try: 11 # 尝试连接到 localhost:389 上的 openldap 服务 12 conn = ldap.initialize(\"ldap://localhost:389\") 13 conn.simple_bind_s(\"cn=admin,dc=example,dc=org\", \"admin\") # 请使用有效的管理员 DN 和密码 14 connections.append(conn) 15 result = conn.search_s(\"dc=example,dc=org\", ldap.SCOPE_SUBTREE) 16 print(result) 17 time.sleep(0.5) 18 except ldap.LDAPError as e: 19 print(f\"LDAP error occurred: {e}\") 20 break 21 while True: 22 # 保持程序运行，以保持占用文件描述符 23 pass 24 except Exception as e: 25 print(f\"An error occurred: {e}\") 26 finally: 27 # 关闭所有创建的 LDAP 连接 28 for conn in connections: 29 try: 30 conn.unbind() 31 except ldap.LDAPError: 32 pass 33 34 35if __name__ == \"__main__\": 36 main()"},{"id":"b46","type":"paragraph","html":"

sleep 控制连接建立的速度，可调整，或者去掉。注意，ldap包有几个系统依赖的，不然安装不上。

","text":"sleep 控制连接建立的速度，可调整，或者去掉。注意，ldap包有几个系统依赖的，不然安装不上。"},{"id":"b47","type":"paragraph","html":"

压测结果图：

","text":"压测结果图："},{"id":"b48","type":"paragraph","html":"

","text":""}],"source":"$0:f:0:1:0:props:children:props:children:1:props:children:props:children:props:children:0:props:sources:346","originalUrl":"https://mephisto.cc/tech/openldap-monitor/","excerpt":"OpenLDAP监控示例"},"shouldTranslate":true}],"$L1d"]}]