I thought I'd scrubbed out the old freeipa server (replaced by 2 shiny new ones) but I keep seeing references to it in /var/log/krb5kdc.log on one of the new ipa servers.
freeipa-a krb5kdc[959452](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19)}) 10.95.96.52: CLIENT_NOT_FOUND: host/freeipa.domain@DOMAIN for krbtgt/DOMAIN@DOMAIN, Client not found in Kerberos database
Its not clear from this message what client/service is still pointing at the old host.
If I do 'ipa-replica-manage dnarange-show' - all I see are the 2 new replicas
'ipa config-show | grep "CA renewal master"' - shows the new host
Where else should I be looking?