What were you trying to do that didn't work?

After upgrading IPA to latest version healthcheck started compaing about missing or\nincorrectly configured system indexes

What is the impact of this issue to you?

Production.

Please provide the package NVR for which the bug is seen:

 

ipa-server-4.12.2-14.el9_6.5.x86_64                         Sun Oct 19 18:27:12 2025

Actual results

 

[user@idm1 ~]$ sudo ipa-healthcheck
[
  {
    "source": "ipahealthcheck.ds.backends",
    "check": "BackendsCheck",
    "result": "CRITICAL",
    "uuid": "a5996f17-d25d-4ef5-97fe-00c5cb2cd766",
    "when": "20251020040346Z",
    "duration": "0.170746",
    "kw":

{       "key": "DSBLE0007",       "items": [         "cn=changelog"       ],       "msg": "System indexes are essential for proper directory server operation. Missing or\nincorrectly configured system indexes can lead to poor search performance, replication\nissues, and other operational problems.\n\nThe following system indexes should be present with correct configuration:\n- entryrdn: index type 'subtree'\n- parentId: index type 'eq' with matching rule 'integerOrderingMatch'\n- ancestorId: index type 'eq' with matching rule 'integerOrderingMatch'\n- objectClass: index type 'eq'\n- aci: index type 'pres'\n- nscpEntryDN: index type 'eq'\n- nsUniqueId: index type 'eq'\n- nsds5ReplConflict: index types 'eq', 'pres'\n- nsCertSubjectDN: index type 'eq'\n- numsubordinates: index type 'pres'\n- nsTombstoneCSN: index type 'eq'\n- targetuniqueid: index type 'eq'\n- changeNumber: index type 'eq' with matching rule 'integerOrderingMatch'\n- entryusn: index type 'eq' with matching rule 'integerOrderingMatch'\n\nCurrent discrepancies:\n- Index parentId missing matching rule: integerOrderingMatch\n- Unable to check index ancestorId: No object exists given the filter criteria: ancestorId (&(&(objectclass=nsIndex))(|(cn=ancestorId)))\n"     }

  },
  {
    "source": "ipahealthcheck.ds.backends",
    "check": "BackendsCheck",
    "result": "CRITICAL",
    "uuid": "28e3912a-02e5-4335-a3cc-8acd3d95a8d2",
    "when": "20251020040346Z",
    "duration": "0.170759",
    "kw":

{       "key": "DSBLE0007",       "items": [         "o=ipaca"       ],       "msg": "System indexes are essential for proper directory server operation. Missing or\nincorrectly configured system indexes can lead to poor search performance, replication\nissues, and oth er operational problems.\n\nThe following system indexes should be present with correct configuration:\n- entryrdn: index type 'subtree'\n- parentId: index type 'eq' with matching rule 'integerOrde ringMatch'\n- ancestorId: index type 'eq' with matching rule 'integerOrderingMatch'\n- objectClass: index type 'eq'\n- aci: index type 'pres'\n- nscpEntryDN: index type 'eq'\n- nsUniqueId: index ty pe 'eq'\n- nsds5ReplConflict: index types 'eq', 'pres'\n- nsCertSubjectDN: index type 'eq'\n- numsubordinates: index type 'pres'\n- nsTombstoneCSN: index type 'eq'\n- targetuniqueid: index type 'eq '\n- entryusn: index type 'eq' with matching rule 'integerOrderingMatch'\n\nCurrent discrepancies:\n- Index parentId missing matching rule: integerOrderingMatch\n- Unable to check index ancestorId:  No object exists given the filter criteria: ancestorId (&(&(objectclass=nsIndex))(|(cn=ancestorId)))\n"     }

  },
  {
    "source": "ipahealthcheck.ds.backends",
    "check": "BackendsCheck",
    "result": "CRITICAL",
    "uuid": "1853372d-c03a-4e5e-8385-91c65898c1b7",
    "when": "20251020040346Z",
    "duration": "0.170761",
    "kw":

{       "key": "DSBLE0007",       "items": [         "dc=pubalibank,dc=com,dc=bd"       ],       ],       "msg": "System indexes are essential for proper directory server operation. Missing or\nincorrectly configured system indexes can lead to poor search performance, replication\nissues, and oth er operational problems.\n\nThe following system indexes should be present with correct configuration:\n- entryrdn: index type 'subtree'\n- parentId: index type 'eq' with matching rule 'integerOrde ringMatch'\n- ancestorId: index type 'eq' with matching rule 'integerOrderingMatch'\n- objectClass: index type 'eq'\n- aci: index type 'pres'\n- nscpEntryDN: index type 'eq'\n- nsUniqueId: index ty pe 'eq'\n- nsds5ReplConflict: index types 'eq', 'pres'\n- nsCertSubjectDN: index type 'eq'\n- numsubordinates: index type 'pres'\n- nsTombstoneCSN: index type 'eq'\n- targetuniqueid: index type 'eq '\n- entryusn: index type 'eq' with matching rule 'integerOrderingMatch'\n\nCurrent discrepancies:\n- Index parentId missing matching rule: integerOrderingMatch\n- Unable to check index ancestorId:  No object exists given the filter criteria: ancestorId (&(&(objectclass=nsIndex))(|(cn=ancestorId)))\n"     }

  }
]