On 10/22/18 2:10 PM, Roderick Johnstone via FreeIPA-users wrote:
Hi
This is ipa-server-4.5.4-10.el7_5.4.4.x86_64 on RHEL7.5.
I've got four preserved accounts (out of a few hundred preserved accounts).
On two of the servers they are showing up correctly as preserved with this command: ipa user-show <username>.
On the third server the same command shows the users with the preserved attribute set to false.
Based on a few tests changing (other) accounts it seems that replication is generally working fine between all the servers.
But:
- The ipa_check_consistency script is showing all three servers with
the same (correct) number of preserved and active users and is showing a good replication status for all server replication agreements.
So its not showing fewer preserved accounts on one server correctly.
- I'm not seeing any replication conflicts on any of the servers
through commands like this:
# ldapsearch -x -D "cn=directory manager" -W -b "dc=example,dc=com" "nsds5ReplConflict=*" * nsds5ReplConflict
Hi,
which version of 389-ds is installed? In recent versions (>= 1.3.7.4, please see ticket 49043 [1]), you need to use the following search to retrieve the conflict entries: ldapsearch -x -D "cn=Directory Manager" -W -b "dc=example,dc=com" "(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" * nsds5ReplConflict
(without objectclass=ldapsubentry, the search won't return any result).
flo
[1] https://pagure.io/389-ds-base/issue/49043
Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: nsds5ReplConflict=* # requesting: * nsds5ReplConflict #
# search result search: 2 result: 0 Success
# numResponses: 1
- The dirsrv error log on server with the users not showing as
preserved is showing the following entries from last May:
[11/May/2018:10:09:31.330807982 +0100] - ERR - managed-entries-plugin - mep_mod_post_op - Unable to find config for origin entry "uid=<user>,cn=deleted users,cn=accounts,cn=provisioning,dc=example,dc=com". [11/May/2018:10:09:36.294657019 +0100] - ERR - NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a change for uid=<user>,cn=users,cn=accounts,dc=example,dc=com (uniqid: f132de25-54fa11e8-b4d6ec15-cd33af38, optype: 64) to changelog csn 5af55dc9000600040000
I'd appreciate any thoughts as to why there might be an inconsistency between servers despite there apparently being no replication conflicts and no indication in the ipa_check_consistency script output.
What might be the best way to resolve this inconsistency between servers?
Thanks
Roderick Johnstone
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...