Upgrade failure
by Gordon Messmer
On Friday, I updated one of several systems that I manage from version
1.2.11.15 to version 1.2.11.25. Thereafter, the service was unable to
start. The error indicates a problem with SSL that I don't understand.
I've included the relevant section from the "error" log below.
After reverting to the old package, the service starts again.
Does anyone understand this error and have a pointer on resolving it?
yum.log:
Sep 20 15:35:43 Updated: 389-ds-base-libs-1.2.11.15-22.el6_4.x86_64
Sep 20 15:36:24 Updated: 389-ds-base-1.2.11.15-22.el6_4.x86_64
Nov 22 15:03:40 Updated: 389-ds-base-libs-1.2.11.25-1.el6.x86_64
Nov 22 15:05:17 Updated: 389-ds-base-1.2.11.25-1.el6.x86_64
error:
[22/Nov/2013:15:05:08 -0800] - check_and_set_import_cache: pagesize:
4096, pages: 980670, procpages: 52580
[22/Nov/2013:15:05:08 -0800] - Import allocates 1569072KB import cache.
[22/Nov/2013:15:05:08 -0800] Upgrade DN Format - userRoot: Start upgrade
dn format.
[22/Nov/2013:15:05:08 -0800] Upgrade DN Format - Instance userRoot in
/var/lib/dirsrv/slapd-master1/db/userRoot is up-to-date
[22/Nov/2013:15:05:14 -0800] - 389-Directory/1.2.11.25 B2013.325.1951
starting up
[22/Nov/2013:15:05:15 -0800] slapd_get_unlocked_key_for_cert - Error:
could not find any unlocked slots for certificate
[E=postmaster(a)xxx.com,CN=mail.xxx.com,O=xxx,
L=Seattle,ST=Washington,C=US,OID.2.5.4.13=5t6jP8FugTLuYrW8]. Please
review your TLS/SSL configuration. The following slots were found:
[22/Nov/2013:15:05:15 -0800] slapd_get_unlocked_key_for_cert - Slot [NSS
User Private Key and Certificate Services] token [Internal (Software)
Token] was locked.
[22/Nov/2013:15:05:15 -0800] - Can't get private key from cert
Server-Cert in attrcrypt_fetch_private_key: -8049 - Unrecognized Object
IDentifier.
[22/Nov/2013:15:05:15 -0800] - Error: unable to initialize attrcrypt
system for userRoot
[22/Nov/2013:15:05:16 -0800] - start: Failed to start databases, err=-1
Unknown error: -1
[22/Nov/2013:15:05:16 -0800] - Failed to start database plugin ldbm database
[22/Nov/2013:15:05:16 -0800] - WARNING: ldbm instance userRoot already
exists
[22/Nov/2013:15:05:16 -0800] - ldbm_config_read_instance_entries: failed
to add instance entry cn=userRoot,cn=ldbm database,cn=plugins,cn=config
[22/Nov/2013:15:05:16 -0800] - ldbm_config_load_dse_info: failed to read
instance entries
[22/Nov/2013:15:05:16 -0800] - start: Loading database configuration failed
[22/Nov/2013:15:05:16 -0800] - Failed to start database plugin ldbm database
[22/Nov/2013:15:05:16 -0800] - Error: Failed to resolve plugin dependencies
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin 7-bit check is
not started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin Account
Usability Plugin is not started
[22/Nov/2013:15:05:16 -0800] - Error: accesscontrol plugin ACL Plugin is
not started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin ACL
preoperation is not started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin Auto
Membership Plugin is not started
[22/Nov/2013:15:05:16 -0800] - Error: object plugin Class of Service is
not started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin deref is not
started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin HTTP Client is
not started
[22/Nov/2013:15:05:16 -0800] - Error: database plugin ldbm database is
not started
[22/Nov/2013:15:05:16 -0800] - Error: object plugin Legacy Replication
Plugin is not started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin Linked
Attributes is not started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin Managed
Entries is not started
[22/Nov/2013:15:05:16 -0800] - Error: object plugin Multimaster
Replication Plugin is not started
[22/Nov/2013:15:05:16 -0800] - Error: preoperation plugin Pass Through
Authentication is not started
[22/Nov/2013:15:05:16 -0800] - Error: object plugin Roles Plugin is not
started
[22/Nov/2013:15:05:16 -0800] - Error: object plugin Views is not started
10 years, 4 months
Replication issue after improper shutdown
by Sugantha J
Hi Everyone
I am running 389 DS 1.2.8.2 in CentOS 4.8. I have a multi master setup, with 12 LDAP servers. Everything was working fine, till one of the boxes (ldapw02) suddenly crashed. When it came back up, I see the following in the error log,
[25/Nov/2013:20:26:00 -0500] - 389-Directory/1.2.8.2 B2013.028.104 starting up
[25/Nov/2013:20:26:01 -0500] - Detected Disorderly Shutdown last time Directory Server was running, recovering database.
[25/Nov/2013:20:26:03 -0500] NSMMReplicationPlugin - replica_check_for_data_reload: Warning: data for replica o=EmpData does not match the data in the changelog (replica data (5293f8a1000000040000) > changelog (5293f89b000000080000)). Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized.
[25/Nov/2013:20:26:03 -0500] - slapd started. Listening on All Interfaces port 389 for LDAP requests
[25/Nov/2013:20:30:32 -0500] NSMMReplicationPlugin - changelog program - agmt="cn=ldapw022toroon63dsaw03" (toroon63dsaw03:389): CSN 5293f761000000020000 not found, we aren't as up to date, or we purged
[25/Nov/2013:20:30:32 -0500] NSMMReplicationPlugin - agmt="cn=ldapw022toroon63dsaw03" (toroon63dsaw03:389): Data required to update replica has been purged. The replica must be reinitialized.
[25/Nov/2013:20:30:32 -0500] NSMMReplicationPlugin - changelog program - agmt="cn=ldapw022toroon63ldapw03" (toroon63ldapw03:389): CSN 5293f761000000020000 not found, we aren't as up to date, or we purged
[25/Nov/2013:20:30:32 -0500] NSMMReplicationPlugin - agmt="cn=ldapw022toroon63ldapw03" (toroon63ldapw03:389): Data required to update replica has been purged. The replica must be reinitialized.
[25/Nov/2013:20:30:32 -0500] NSMMReplicationPlugin - agmt="cn=ldapw022toroon63ldapw03" (toroon63ldapw03:389): Incremental update failed and requires administrator action
[25/Nov/2013:20:30:32 -0500] NSMMReplicationPlugin - agmt="cn=ldapw022toroon63dsaw03" (toroon63dsaw03:389): Incremental update failed and requires administrator action
[25/Nov/2013:20:35:30 -0500] NSMMReplicationPlugin - changelog program - agmt="cn=ldapw022ldapw01" (ldapw01:389): CSN 5293f7f3000000050000 not found, we aren't as up to date, or we purged
[25/Nov/2013:20:35:30 -0500] NSMMReplicationPlugin - agmt="cn=ldapw022ldapw01" (ldapw01:389): Data required to update replica has been purged. The replica must be reinitialized.
[25/Nov/2013:20:35:30 -0500] NSMMReplicationPlugin - agmt="cn=ldapw022ldapw01" (ldapw01:389): Incremental update failed and requires administrator action.
Replication seems to work to 'ldapw02' from all other boxes, but replication from 'ldapw02' does not work. The issue disappears when I initialize all the neighbors from the affected box, but I will have to find the root cause for this, since this seems to happen very frequently. Also, I am not able to diagnose the reason for the crash, since installing 'debuginfo' package is out of my scope. I see a similar issue being discussed here,
http://thr3ads.net/fedora-directory-users/2007/10/176314-Re-Cant-locate-C...
and in response to this discussion, the following bug was filed,
https://bugzilla.redhat.com/show_bug.cgi?id=388021
It is mentioned that this is fixed in "fedora-ds-base-1.2.0", so I hope I should have this fix in my 389 server 1.2.8.2. Do you have any idea as to why I am still getting this problem? Also, we did a recent LDAP upgrade from 389 DS 1.1.2 to 1.2.8.2, after which I see this problem happening in one or the other LDAP server. Is this related? Any help is appreciated.
Regards
Sugantha J
10 years, 4 months
migrate-ds-admin.pl
by Alberto Viana
Hi,
I'm trying to migrate from old machine (389-Directory/1.2.10.12) to a new
machine (389-Directory/1.3.2.6) using the migrate script and i'm getting
the following errors:
migrate-ds-admin.pl --oldsroot /opt/dirsrv.20131029/ --actualsroot
/opt/dirsrv --instance slapd-RNP
General.ConfigDirectoryAdminPwd=thepasswordvalue=cskfNjf78 --debug
+Copying database directory
/opt/dirsrv.20131029/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot to
/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot
The index for the attribute 'entryusn' in the database directory
'/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot' will be removed and
re-created.
+Removing file
/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/entryusn.db4
+Re-creating index file
/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/entryusn.db4:
/opt/dirsrv/lib/dirsrv/slapd-RNP/db2index -n "NetscapeRoot" -t "entryusn"
Could not re-create the index file
'/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot/entryusn.db4'.
Error: [02/Dec/2013:10:35:13 -0200] - WARNING: Import is running with
nsslapd-db-private-import-mem on; No other process is allowed to access the
database
[02/Dec/2013:10:35:13 -0200] - check_and_set_import_cache: pagesize: 4096,
pages: 254875, procpages: 56270
[02/Dec/2013:10:35:13 -0200] - WARNING: After allocating import cache
407800KB, the available memory is 611700KB, which is less than the soft
limit 1048576KB. You may want to decrease the import cache size and rerun
import.
[02/Dec/2013:10:35:13 -0200] - Import allocates 407800KB import cache.
[02/Dec/2013:10:35:13 -0200] - dbp->open("NetscapeRoot/id2entry.db")
failed: Permission denied (13)
[02/Dec/2013:10:35:13 -0200] - Instance directory
/opt/dirsrv/var/lib/dirsrv/slapd-RNP/db/NetscapeRoot may not be writable
[02/Dec/2013:10:35:13 -0200] - dblayer_instance_start fail: Permission
denied (13)
[02/Dec/2013:10:35:13 -0200] - db2ldif: Failed to init instance
Due to the error "*Import is running with nsslapd-db-private-import-mem on;
No other process is allowed to access the database*" it seems the script
does not create the NetscapeRoot folder. Am I right?
Any clues?
Thanks
10 years, 4 months