Description of problem:

In Ipa, we are using content syncronization plugin to let DNS component be
aware of changes under "cn=dns"

We had a bug already fixed to exclude ipaca backend from retro changelog:

bz 1346321

this has helped to prevent some deadlocks.

But there's still some improvement here. In ipa we have a high number of
updates in some situations like provisioning users in environments with large
static groups or/and compat plugin enabled.

Each time an update is done to the db, a retro changelog operation is logged.

I think we will improve performance a lot and have less issues (lots of issues
with updates in the retro changelog are seen at customer side) if we could
restrict, in IPA, the retro changelog operations to dns subtree only.

We don't have many dns updates.

I am asking here whether an enhancement is possible to restrict by DNS subtree.

Instead of excluding "o=ipaca", the change will be similar but this time we
need an include suffix clause:


nsslapd-include-suffix: "cn=dns,...."