We have 4 IPA servers setup in a circular replication (each server can replicate to 2 other servers), which created a replication that looks like an 'O' .. but we have some replication issues:
note: we are using freeIPA as DNS and Users authentication and authorization.
1. some records do not seem to get replicated when they get updated to all other nodes
2. almost weekly replication stops with many open files, ldapwhoami processes, etc.
- replication-status.html usually will show Update Status = 'Error (1) Can't acquire busy server'
- A restart of directory services sometimes fixes this, and sometimes a server reboot is required
- no indication of failure in log files, other than 'can not contact ldap server'
- sometimes restart of named-pkcs11 clears replication
- The Max CSN number on all nodes has a timestamp that is consistently in the future. Which is very odd, and might be related. Easy to check by making a change on one of them, and then checking the CSN from the config.
Our architecture is 2 data centers, with a pair of servers in each. For reliability we want to make all servers available to each data center. We are running on Centos 7.3.
It seems were are missing something somewhere to help make this reliable. Errors 2-3 times a week is becoming a support nightmare.
Questions are:
1. should we have a different architecture (eg, 1 master, multiple slaves, multi-master)?
2. should we replicate less frequently? (what is best practice)
3. currently known issues with replication on Centos 7.3?
Thanks,
-lance