On Wed, Sep 16, 2020 at 05:26:14AM -0000, Boris Sukhinin via FreeIPA-users wrote:
It seems the problem is with a single replica only. Is was
assigned request id range 19990001-20000000. Requests
19990001-19990008 were submitted some time ago, and requests
19990001-19990005 were overwritten in my recent attempts to
install another replica. Note that CA doesn't always overwrite the
first request, it actually increments request number, but still
reusing already assigned ids.
Trying to install a replica one or two more times will solve the
problem as CA will naturally start using previously unused request
ids (I'm planning to restore overwritten requests from backup
after that). But I don't like this solution because it doesn't
tell us what exactly happened, why did it happen and how to avoid
it in the future.
That being said, is there a way to verify the problem is actually
with VLV indices without submitting new requests? Running
ldapsearch -LLL -x -b "ou=ca,ou=requests,o=ipaca" -D "cn=Directory
Manager" -W "(requeststate=*)" on every replica shows all the
requests 19990001-19990008. Maybe you could point me to the exact
mechanism / query / source code snippet used to select the next
request id?
Regards, Boris
Hi Boris,
Yes, performing a VLV search is a bit fiddly but you can do it like
this:
$ ldapsearch -LLL -D "cn=Directory Manager" -w $PASS -s one \
-b ou=ca,ou=requests,o=ipaca '(requeststate=*)' \
-E sss=requestId -E vlv=1/0:0820000000 requestId
This should show what, according to the VLV index, is the highest
number in the range that has been used so far. The next number to
be used will be one greater than that. (Note that there may be
an entry greater than 20000000 in the result - it can be ignored).
I would be interested to see the exact command output if you are
willing to share it. Maybe I didn't get the command or the VLV
inputs exactly correct...
Cheers,
Fraser