In reply to myself... I got loglevel etc working and discovered that the qmail-group error group:_fatal:_expand_group_attr:_filtermember:_too_many_objects/
was due to bad data from the ldap server... specifically some users had multiple entries for mail: and also for uid: When I cleaned these up to be single-valued it worked correctly Ruairi