Export data from a Directory Server backend in LDIF format.
To export data from a remote Directory Server, the Directory Server must be running and connection parameters must be supplied. You can specify options to include or exclude specific attributes and branches of the tree, and to include or exclude entries matching a given filter. The data may be appended to an existing file instead of overwriting it, and the output may be optionally compressed.
This tool features both an offline mode of operation as well as the ability to schedule an operation to run within the Directory Server's process. To schedule an operation supply LDAP connection options that allow this tool to communicate with the server through its task interface. Tasks can be scheduled to run immediately or at a later time (see Task Scheduling Options below). Once scheduled, tasks can be managed using the manage-tasks tool.
Export all data from the userRoot backend of the local Directory Server into the file 'userRoot.ldif'. The Directory Server may be running or stopped:
export-ldif --backendID userRoot --ldifFile userRoot.ldif
Export data under a specific branch from the userRoot backend of the local Directory Server into a compressed file. Operational attributes are excluded from the exported data, and long lines are wrapped at column 80. The Directory Server may be running or stopped:
export-ldif --backendID userRoot --ldifFile userRoot.ldif.gz --compress \
--includeBranch ou=people,dc=example,dc=com --excludeOperational \
--wrapColumn 80
Export data from the userRoot backend into compressed, encrypted, and signed LDIF file userRoot.ldif.gz.encrypted. The encryption key will be generated from an interactively provided passphrase:
export-ldif --backendID userRoot --ldifFile userRoot.ldif.gz.encrypted \
--encryptLDIF --sign --compress
Invoke a task to export all data from the userRoot backend of the Directory Server into a file on the server's file system. The Directory Server may be remote and it must be running:
export-ldif --task --hostname server1 --port 389 \
--bindDN uid=admin,dc=example,dc=com --bindPassword password \
--backendID userRoot --ldifFile userRoot.ldif
For examples and help with LDAP options see LDAP Option Help. For help with SASL authentication, see SASL Option Help
-V
--version
| Description | Display Directory Server version information |
-H
--help
| Description | Display general usage information |
--help-ldap
| Description | Display help for using LDAP options |
--help-sasl
| Description | Display help for using SASL options |
--help-debug
| Description | Display help for using debug options |
| Advanced | Yes |
-Z
--useSSL
| Description | Use SSL for secure communication with the server |
-q
--useStartTLS
| Description | Use StartTLS to secure communication with the server |
--useNoSecurity
| Description | Use no security when communicating with the server |
-h {host}
--hostname {host}
| Description | Directory Server hostname or IP address |
| Default Value | localhost |
| Required | No |
| Multi-Valued | No |
-p {port}
--port {port}
| Description | Directory Server port number |
| Default Value | 389 |
| Required | No |
| Multi-Valued | No |
-D {bindDN}
--bindDN {bindDN}
| Description | DN used to bind to the server |
| Default Value | cn=Directory Manager |
| Required | No |
| Multi-Valued | No |
-w {bindPassword}
--bindPassword {bindPassword}
| Description | Password used to bind to the server |
| Required | No |
| Multi-Valued | No |
-j {bindPasswordFile}
--bindPasswordFile {bindPasswordFile}
| Description | Bind password file |
| Required | No |
| Multi-Valued | No |
-o {name=value}
--saslOption {name=value}
| Description | SASL bind options |
| Required | No |
| Multi-Valued | Yes |
-X
--trustAll
| Description | Trust all server SSL certificates |
-P {truststorePath}
--trustStorePath {truststorePath}
| Description | Certificate truststore path |
| Default Value | /home/centos/workspace/Core-Release-Pipeline/build/package/PingDirectory/config/truststore |
| Required | No |
| Multi-Valued | No |
-T {truststorePassword}
--trustStorePassword {truststorePassword}
| Description | Certificate truststore PIN |
| Required | No |
| Multi-Valued | No |
-U {path}
--trustStorePasswordFile {path}
| Description | Certificate truststore PIN file |
| Required | No |
| Multi-Valued | No |
--trustStoreFormat {trustStoreFormat}
| Description | Certificate truststore format |
| Required | No |
| Multi-Valued | No |
-K {keystorePath}
--keyStorePath {keystorePath}
| Description | Certificate keystore path |
| Required | No |
| Multi-Valued | No |
-W {keystorePassword}
--keyStorePassword {keystorePassword}
| Description | Certificate keystore PIN |
| Required | No |
| Multi-Valued | No |
-u {keystorePasswordFile}
--keyStorePasswordFile {keystorePasswordFile}
| Description | Certificate keystore PIN file |
| Required | No |
| Multi-Valued | No |
--keyStoreFormat {keyStoreFormat}
| Description | Certificate keystore format |
| Required | No |
| Multi-Valued | No |
-N {nickname}
--certNickname {nickname}
| Description | Nickname of the certificate for SSL client authentication |
| Required | No |
| Multi-Valued | No |
--useAdministrativeSession
| Description | Attempt to use an administrative session to have operations processed on a dedicated pool of worker threads. This may be useful when trying to diagnose problems in a server that is unresponsive because all normal worker threads are busy processing other requests |
--propertiesFilePath {propertiesFilePath}
| Description | Path to the file that contains default property values used for command-line arguments |
| Required | No |
| Multi-Valued | No |
--usePropertiesFile
| Description | Specify that a properties file will be used to get default command-line argument values |
--script-friendly
| Description | Use script-friendly mode |
--task
| Description | Indicates that this tool should be invoked as a task which runs inside the Directory Server rather than as a separate process. At present, this argument is optional, but in a future release it may be required for running as a task |
-t {startTime}
--start {startTime}
| Description | Indicates the date/time, expressed in format 'YYYYMMDDhhmmss', when the operation starts when scheduled as a server task. A value of '0' causes the task to be scheduled for immediate execution. When this option is specified, the operation is scheduled to start at the specified time, after which this utility will exit immediately |
| Required | No |
| Multi-Valued | No |
--startAlert
| Description | Generate an administrative alert when the task starts running |
--successAlert
| Description | Generate an administrative alert when the task completes successfully |
--errorAlert
| Description | Generate an administrative alert when the task fails to complete successfully |
--startNotify {emailAddress}
| Description | Email address of a recipient to be notified when this task starts running |
| Required | No |
| Multi-Valued | Yes |
--completionNotify {emailAddress}
| Description | Email address of a recipient to be notified when the task completes, regardless of whether it succeeded or failed |
| Required | No |
| Multi-Valued | Yes |
--successNotify {emailAddress}
| Description | Email address of a recipient to be notified when this task completes successfully |
| Required | No |
| Multi-Valued | Yes |
--errorNotify {emailAddress}
| Description | Email address of a recipient to be notified if an error occurs when this task executes |
| Required | No |
| Multi-Valued | Yes |
--dependency {taskID}
| Description | ID of a task upon which this task depends. A task will not start execution until all its dependencies have completed execution |
| Required | No |
| Multi-Valued | Yes |
--failedDependencyAction {action}
| Description | Action this task will take should one of its dependent tasks fail. The value must be one of the following: PROCESS,CANCEL,DISABLE. If not specified, the default value is CANCEL |
| Required | No |
| Multi-Valued | Yes |
-Q
--quiet
| Description | Use quiet mode |
-l {ldifFile}
--ldifFile {ldifFile}
| Description | Path to the LDIF file to be written |
| Required | Yes |
| Multi-Valued | No |
-a
--appendToLDIF
| Description | Append an existing LDIF file rather than overwriting it |
-n {backendName}
--backendID {backendName}
| Description | Backend ID for the backend to export |
| Required | Yes |
| Multi-Valued | No |
-b {branchDN}
--includeBranch {branchDN}
| Description | Base DN of a branch to include in the LDIF export |
| Required | No |
| Multi-Valued | Yes |
-B {branchDN}
--excludeBranch {branchDN}
| Description | Base DN of a branch to exclude from the LDIF export |
| Required | No |
| Multi-Valued | Yes |
-i {attribute}
--includeAttribute {attribute}
| Description | Attribute to include in the LDIF export |
| Required | No |
| Multi-Valued | Yes |
-e {attribute}
--excludeAttribute {attribute}
| Description | Attribute to exclude from the LDIF export |
| Required | No |
| Multi-Valued | Yes |
-I {filter}
--includeFilter {filter}
| Description | Filter to identify entries to include in the LDIF export |
| Required | No |
| Multi-Valued | Yes |
-E {filter}
--excludeFilter {filter}
| Description | Filter to identify entries to exclude from the LDIF export |
| Required | No |
| Multi-Valued | Yes |
-O
--excludeOperational
| Description | Exclude operational attributes from the LDIF export |
-R
--excludeReplication
| Description | Exclude replication related attributes and entries from the LDIF export |
-S
--excludeSoftDelete
| Description | Exclude soft delete entries from the LDIF export |
--wrapColumn {wrapColumn}
| Description | Column at which to wrap long lines (0 for no wrapping) |
| Lower Bound | 0 |
| Default Value | 0 |
| Required | No |
| Multi-Valued | No |
-c
--compress
| Description | Compress the LDIF data as it is exported using gzip compression |
--maxMegabytesPerSecond {MB}
| Description | The maximum rate in megabytes per second at which the LDIF file may be written. Imposing a maximum write rate can help avoid incurring a performance penalty that may result from saturating the storage subsystem, especially on systems that cannot fully cache the data in memory. If this is not provided, then no maximum rate will be imposed. If a value is given, then it must be between 1 and 2047, inclusive |
| Lower Bound | 1 |
| Upper Bound | 2047 |
| Required | No |
| Multi-Valued | No |
--postExportProcessor {nameOrDN}
| Description | The name or DN of a post-LDIF-export task processor that should be invoked after the LDIF export has been successfully generated. This argument can only be used when invoking the LDIF export as an administrative task |
| Required | No |
| Multi-Valued | Yes |
-y
--encryptLDIF
| Description | Encrypt the LDIF data as it is exported. If either the --promptForEncryptionPassphrase or --encryptionPassphraseFile argument is provided, then that passphrase will be used to generate the encryption key. If the --encryptionSettingsDefinitionID argument is provided, then the encryption key will be generated from that definition. If no passphrase or encryption settings definition ID was specified, then the server's preferred encryption settings definition will be used, or an internal key shared among servers in the topology will be used if there are no encryption settings definitions. If neither the --encrypt nor the --doNotEncrypt argument is provided, then the determination as to whether to encrypt the data will be made based on the server's encrypt-backups-by-default global configuration property. Encrypted LDIF exports can be decrypted with the encrypt-file tool |
--promptForEncryptionPassphrase
| Description | Interactively prompt for a passphrase that can be used to generate the encryption key. This argument can only be used if the --encryptLDIF argument is also provided, and it cannot be used if either the --encryptionPassphraseFile or the --encryptionSettingsDefinitionID argument is provided, nor can it be used when running the LDIF export as a task |
--encryptionPassphraseFile {path}
| Description | The path to a file that contains a passphrase that can be used to generate the encryption key. This argument can only be used if the --encryptLDIF argument is also provided, and it cannot be used if either the --promptForEncryptionPassphrase or the --encryptionSettingsDefinitionID argument is provided. The passphrase file must exist on the server system, regardless of whether the export is running locally or as a task, and an absolute path is recommended when running as a task |
| Required | No |
| Multi-Valued | No |
--encryptionSettingsDefinitionID {path}
| Description | The identifier for the encryption settings definition that will be used to generate the encryption key. This argument can only be used if the --encrypt argument is also provided, and it cannot be used if either the --promptForEncryptionPassphrase or the --encryptionPassphraseFile argument is provided |
| Required | No |
| Multi-Valued | No |
--doNotEncrypt
| Description | Do not encrypt the LDIF export, even if exports are normally encrypted by default |
-s
--sign
| Description | Sign the contents of the LDIF file |
--logFilePath {logFilePath}
| Description | Echo the console output to the specified log file, instead of the default ' |
| Required | No |
| Multi-Valued | No |