slapcat — quick reference
Export a database
slapcat reads the on-disk slapd backend and writes LDIF. On the MDB backend it can run while slapd is active because MDB supports consistent reads; other backends may require a stopped or read-only server for a trustworthy dump. Treat every export as sensitive: LDIF can include password hashes, ACLs, and operational attributes that a normal LDAP client query never returns.
On this lab host the dynamic configuration lives under /etc/openldap/slapd.d, database 0 is cn=config, and database 2 holds dc=example,dc=com.
| When to use | Command |
|---|---|
| Dump the data database with database number 2 | sudo slapcat -F /etc/openldap/slapd.d -n 2 |
Dump the cn=config database |
sudo slapcat -F /etc/openldap/slapd.d -n 0 |
| Select a database by naming-context suffix | sudo slapcat -F /etc/openldap/slapd.d -b 'dc=example,dc=com' |
| Save an LDIF backup instead of printing it | sudo slapcat -F /etc/openldap/slapd.d -n 2 -l /root/ldap-data.ldif |
| Export entries matching a filter | sudo slapcat -F /etc/openldap/slapd.d -n 2 -a '(objectClass=person)' |
| Limit the export to a subtree DN | sudo slapcat -F /etc/openldap/slapd.d -n 2 -s 'ou=people,dc=example,dc=com' |
Add # id=... markers while dumping |
sudo slapcat -F /etc/openldap/slapd.d -n 2 -v |
| Include syncrepl context CSN metadata | sudo slapcat -F /etc/openldap/slapd.d -n 2 -g |
| Select the database by LDAP URI | sudo slapcat -F /etc/openldap/slapd.d -H ldap:///dc=example,dc=com |
Inspect the export
Read a bounded sample or count lines and DNs before moving the LDIF to backup storage.
| When to use | Command |
|---|---|
| Show the opening entries | sudo slapcat -F /etc/openldap/slapd.d -n 2 | head -40 |
| Count exported LDIF lines | sudo slapcat -F /etc/openldap/slapd.d -n 2 | wc -l |
| Count distinct entry DNs | sudo slapcat -F /etc/openldap/slapd.d -n 2 | grep -c '^dn:' |
Help
| When to use | Command |
|---|---|
| Open the full manual | man slapcat |
| Confirm the installed OpenLDAP build | slapd -V |
slapcat — command syntax
Synopsis from OpenLDAP 2.6:
/usr/sbin/slapcat [-afilter] [-bsuffix] [-c] [-ddebug-level] [-fslapd.conf]
[-Fconfdir] [-g] [-HURI] [-lldif-file] [-ndbnum] [-ooption[=value]] [-ssubtree-dn] [-v]Choose either -n or -b; they select the same target in different ways and cannot be combined. -F /etc/openldap/slapd.d makes the RHEL cn=config location explicit. -s limits output to one subtree; -H selects the database through an LDAP URI when that reads clearer than an index.
slapcat — command examples
Essential Inspect the MDB data database
Start by exporting the data database by number. On this lab host, MDB data is database index 2; confirm the index on every server before scripting backups.
sudo slapcat -F /etc/openldap/slapd.d -n 2The first lines show entries under dc=example,dc=com, including operational attributes such as entryCSN that ldapsearch may hide depending on ACLs.
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Example Organization
dc: example
structuralObjectClass: organization
entryUUID: 9b20e92a-1322-1041-9ef2-23da59dd0b8d
creatorsName: cn=admin,dc=example,dc=com
createTimestamp: 20260713162111Z
entryCSN: 20260713162111.363371Z#000000#000#000000The root dn confirms that index 2 selected the data database rather than cn=config.
Essential Count the exported LDIF lines
Count a fresh export before and after a maintenance change to spot an unexpected large difference. This is a quick sanity check, not a backup-integrity test.
sudo slapcat -F /etc/openldap/slapd.d -n 2 | wc -lSample output:
121The lab database contains 121 LDIF lines; use the count only as a baseline for this server.
Essential Count distinct entry DNs
Line count includes blank lines and continuation records. Counting dn: lines gives the number of entries in the export.
sudo slapcat -F /etc/openldap/slapd.d -n 2 | grep -c '^dn:'Sample output:
8Eight entries sit under dc=example,dc=com in this lab; compare both line count and DN count after a migration rehearsal.
Essential Write a protected LDIF backup file
Write the data export to a root-owned location before a migration or a controlled restore test.
sudo slapcat -F /etc/openldap/slapd.d -n 2 -l /root/ldap-data.ldifSuccessful export is normally silent. Restrict access to the file because LDIF can include password hashes, ACLs, and operational attributes.
Common Export the cn=config database
Back up the dynamic configuration separately from user data. Database number 0 is always the config database.
sudo slapcat -F /etc/openldap/slapd.d -n 0 -l /root/ldap-config.ldifSuccessful export is normally silent. Keep this file with the data backup, but do not restore it casually onto a dissimilar server.
Common Select data by suffix
Use the naming-context suffix when it communicates intent better than an index or when database numbering differs between servers.
sudo slapcat -F /etc/openldap/slapd.d -b 'dc=example,dc=com'The output is the LDIF for that naming context. Do not add -n here: slapcat rejects using -b and -n together.
Common Export one subtree with -s
-s limits the dump to one subtree DN. Use it for a focused backup of ou=people or another organizational unit.
sudo slapcat -F /etc/openldap/slapd.d -n 2 -s 'ou=people,dc=example,dc=com'Sample output:
dn: ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: people
structuralObjectClass: organizationalUnit
entryUUID: 9b25b04a-1322-1041-9ef3-23da59dd0b8d
creatorsName: cn=admin,dc=example,dc=com
createTimestamp: 20260713162111Z
dn: uid=jdoe,ou=people,dc=example,dc=com
objectClass: top
objectClass: inetOrgPersonOnly the people subtree and its children appear; the groups branch is omitted.
Common Add entry markers with -v
Verbose mode prefixes each record with # id=..., which helps when correlating an LDIF line number with slapadd -j during a resume.
sudo slapcat -F /etc/openldap/slapd.d -n 2 -v | head -8Sample output:
# id=00000001
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Example Organization
dc: example
structuralObjectClass: organizationThe # id= markers are comments for humans and tools; they are not LDAP attributes.
Advanced Select the database with -H
-H chooses the backend through an LDAP URI when scripts already think in URI terms.
sudo slapcat -F /etc/openldap/slapd.d -H ldap:///dc=example,dc=com | head -6Sample output:
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Example Organization
dc: exampleThe URI names the same naming context as -b 'dc=example,dc=com' on this host.
Advanced Export only matching entries
Use -a for a focused inspection or extraction. The filter is evaluated against stored entries, so test it on a disposable copy before treating it as a migration export.
sudo slapcat -F /etc/openldap/slapd.d -n 2 -a '(objectClass=person)'The output contains matching entries only. -a is documented but deprecated in favor of a URI filter for new automation.
slapcat — when to use / when not
| Use slapcat when | Use something else when |
|---|---|
|
|
slapcat vs ldapsearch
| slapcat | ldapsearch | |
|---|---|---|
| Access path | Opens the local backend files | Queries through LDAP |
| ACLs | Bypasses normal client access controls | Enforces bind identity and ACLs |
| Output | Stored entries including operational attributes | Entries and attributes the bind DN may read |
MDB while slapd runs |
Supported (consistent read) | Supported (normal client path) |
| Best for | Backup, migration, server inspection | Application and administrator queries |
| Typical restore path | slapadd on an offline server | ldapadd / ldapmodify online |
ldapsearch answers “what can this bind DN see over the wire?” slapcat answers “what is physically stored in this backend right now?” Do not treat slapcat output as direct ldapadd input without reviewing ordering and no-user-modification attributes. Pair exports with slappasswd when you need to regenerate {SSHA} hashes for a fresh LDIF instead of copying old hash values blindly.
Related commands
These commands form the client-query and server-backup workflow.
| Command | One line |
|---|---|
| ldapsearch | Search entries through the LDAP protocol. |
| ldapmodify | Apply online LDIF changes. |
| slapadd | Load LDIF into an offline backend. |
| slaptest | Validate configuration before starting slapd. |
| slappasswd | Generate values for LDAP password attributes. |
Browse the full Linux commands cheat sheet reference.
slapcat — interview corner
What is slapcat used for?
It exports an OpenLDAP backend to LDIF, usually for backup, migration, or offline inspection.
A strong answer is:
"slapcat is the server-side LDIF export tool. I use it for a controlled backup and pair it with slapadd only for an offline restore."
What does slapcat -n 0 select?
It selects the cn=config database. The configuration database is always index 0.
A strong answer is:
"Index 0 is cn=config; the application data database has another index that I verify on that server — in our lab it is 2 for dc=example,dc=com."
Can slapcat run while slapd is running?
For MDB, yes: the backend supports a consistent read. Other backends may need slapd stopped or read-only for a consistent dump.
A strong answer is:
"I check the backend. MDB supports safe slapcat reads, but I do not generalize that behavior to every backend or every restore plan."
Can slapcat output be sent directly to ldapadd?
Usually no. It can contain operational attributes and database order that an LDAP client cannot accept without editing and reordering.
A strong answer is:
"slapcat output is designed for slapadd. For ldapadd, I sanitize no-user-modification attributes and ensure parent entries come first."
How is slapcat different from ldapsearch?
slapcat reads the backend directly and can include operational data regardless of ACLs. ldapsearch is a client query subject to bind identity, network path, and ACLs.
A strong answer is:
"ldapsearch shows what the client can see; slapcat shows what is on disk. I use ldapsearch for service validation and slapcat for backup and migration sources."
When would you use slapcat -s instead of -a?
-s limits by subtree DN regardless of object class. -a applies an LDAP filter across the selected database.
A strong answer is:
"I use -s for an OU-focused backup like ou=people, and -a when I need every entry matching a filter such as objectClass=person."
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Wrong naming context is exported | Database index differs on this host | Use -b 'suffix' or -H ldap:///suffix and verify indices in cn=config before scripting. |
-b and -n fail together |
They are mutually exclusive selectors | Choose the suffix or database number, not both. |
| Backup file is readable by others | File permissions were relaxed or location is shared | Move it to root-owned protected storage and rotate exposed credentials if necessary. |
| Export is inconsistent on a non-MDB backend | slapd wrote during the dump |
Follow that backend's consistency guidance; stop or quiesce the server if required. |
ldapadd rejects a slapcat file |
Operational attributes or parent/child order | Strip no-user-modification attributes or restore with offline slapadd instead. |
| Subtree export is empty | -s DN does not exist or typo in case |
Confirm the DN with ldapsearch or a full slapcat sample before relying on the subtree dump. |
| Line count changed but DN count did not | Attribute values grew (longer member lists, etc.) |
Compare grep -c '^dn:' and spot-check changed entries; DN count tracks entry cardinality. |
References
- OpenLDAP slapcat(8) manual{: target="_blank" rel="noopener" }
- OpenLDAP slapadd(8) manual{: target="_blank" rel="noopener" }
- OpenLDAP Administrator's Guide — backup and restore{: target="_blank" rel="noopener" }
- Install and configure OpenLDAP on RHEL Linux
- Configure cn=config with the MDB backend
- OpenLDAP migration examples
