SLAPCAT(8C)

💅 SLAPCAT — the SLAPD database to LDIF glow-up ✨

okay bestie, so slapcat is from section 8C of the manual, and it is literally the tool that turns your slapd(8) database into a pretty little LDIF file. she's giving backup queen energy and I'm obsessed 🎀

---

✨ NAME ✨

slapcat — SLAPD database to LDIF utility 💖

---

🌸 SYNOPSIS 🌸

/usr/bin/slapcat [-afilter] [-bsuffix] [-c] [-ddebug-level]
[-fslapd.conf] [-Fconfdir] [-g] [-HURI] [-lldif-file] [-ndbnum]
[-ooption[=value]] [-ssubtree-dn] [-v]

---

🦋 DESCRIPTION 🦋

so slapcat generates an LDAP Directory Interchange Format (LDIF) output based on what's actually inside a slapd(8) database. she opens whichever database you point her at — determined by the database number or the suffix — and writes the corresponding LDIF to standard output or to a file you specify. and the databases configured as subordinates of that one? they get output too, unless you throw -g at her. periodt 💅

the entry records come out in database order, NOT superior-first order, jsyk. and they include all the attributes stored in the database — both user and operational ones. what they will not include is dynamically generated attributes (like subschemaSubentry, for example). sorry girl, those don't live in the file.

here's the thing bestie: the output of slapcat is meant to be fed to slapadd(8). 😌 it can not generally be fed to ldapadd(1) or other LDAP clients without you editing it first. and that editing would normally include reordering the records into superior-first order and removing the no-user-modification operational attributes. so don't just pipe it and pray, okay? 🙈

---

💖 OPTIONS 💖

• -a filter — only dump the entries that match the asserted filter. like, for example:

slapcat -a \
    "(!(entryDN:dnSubtreeMatch:=ou=People,dc=example,dc=com))"

will dump everything except the "ou=People,dc=example,dc=com" subtree of the "dc=example,dc=com" database. 🫶 Deprecated bestie — use -H ldap:///???(filter) instead.

• -b suffix — use the specified suffix to figure out which database to generate output for. by default, the first database that supports the requested operation gets used. and no, -b can not be used in conjunction with the -n option, pick a lane 💀
• -c — enable continue (ignore errors) mode. and the more times you write -c, the harder slapcat(8) tries. she's persistent like that 🔥
• -d debug-level — enable debugging messages as defined by the specified debug-level; peep slapd(8) for the details.
• -f slapd.conf — specify an alternative slapd.conf(5) file.
• -F confdir — specify a config directory. if you give her both -f and -F, the config file gets read and converted into config directory format and written into the specified directory. if you give her neither, she tries to read the default config directory first before trying the default config file. and if a valid config directory exists, the default config file is just ignored. she said bye 👋
• -g — disable subordinate gluing. only the specified database gets processed, not its glued subordinates (if any). no plus-ones allowed 🚫
• -H URI — use the dn, scope and filter from the URI to only handle matching entries.
• -l ldif-file — write the LDIF to the specified file instead of standard output.
• -n dbnum — generate output for the dbnum-th database listed in the configuration file. the config database slapd-config(5) is always the first database, so use -n 0 to select it. 👑

and again: -n can not be used in conjunction with the -b option. choose one, bestie 😭

• -o option[=value] — specify an option with a(n optional) value. the possible generic options/values are:

syslog=<subsystems>  (see `-s' in slapd(8))
syslog-level=<level> (see `-S' in slapd(8))
syslog-user=<user>   (see `-l' in slapd(8))

ldif_wrap={no|<n>}

n is the number of columns allowed for the LDIF output (n equal to 0 uses the default, corresponding to 78). the minimum is 2, leaving space for one character and one continuation character. use no for no wrap. she can be flexible, she just has boundaries ✨

• -s subtree-dn — only dump entries in the subtree specified by this DN. implies -b subtree-dn if no -b or -n option is given. Deprecated though — use -H ldap:///subtree-dn instead. 🫶
• -v — enable verbose mode. she will tell you everything that's happening, and honestly? we love a transparent queen 🎀

---

😭 LIMITATIONS 😭

for some backend types, your slapd(8) should not be running (or at least, not in read-write mode) while you do this, so that the database stays consistent. lowkey important. but it is always safe to run slapcat with the slapd-mdb(5) and slapd-null(5) backends. 🫶 those two are the safe ones, no cap.

---

🌈 EXAMPLES 🌈

to make a text backup of your SLAPD database and put it in a file called ldif, give the command:

/usr/bin/slapcat -l ldif

---

👑 SEE ALSO 👑

ldap(3), ldif(5), slapadd(8), ldapadd(1), slapd(8)

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

---

🫶 ACKNOWLEDGEMENTS 🫶

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.

---

and that's the whole page bestie, we ate and left no crumbs 💅🌸 this was OpenLDAP 2.7.2, dated 2026/10/21, from the SLAPCAT(8C) manual — mwah, go make that backup 🎀✨