Some time ago I hosed my freeipa setup (RHEL8, 3 servers), probably by
starting yum update pretty much at the same time, without realizing
that it would be better to spread it out a bit. This was at the time I
got the RHEL 8.4 updates.
One server seemed pretty messed up, so I deleted it from the topology
and re-executed the ipa-replica-install.
I deleted some duplicates from the replication, manally fixed the
password issue from
https://github.com/dogtagpki/pki/issues/3650
on the re-installed server.
ipa-healthcheck now reports:
[root@ipa1 ipa-tools]# ipa-healthcheck --failures-only --output-type
human
CRITICAL: ipahealthcheck.ds.dse.DSECheck.DSSKEWLE0003: The time skew is
over 24 hours. Setting nsslapd-ignore-time-skew
to "on" on each replica will allow replication to continue, but if the
time skew continues to increase other serious replication problems can
occur.
ERROR: ipahealthcheck.ds.dse.DSECheck.DSSKEWLE0002: The time skew is
over 12 hours. If this time skew continues to increase
to 24 hours then replication can potentially stop working. Please
continue to
monitor the time skew offsets for increasing values. Setting nsslapd-
ignore-time-skew
to "on" on each replica will allow replication to continue, but if the
time skew
continues to increase other more serious replication problems can
occur.
I got the following from ds389:
[root@ipa1 ipa-tools]# dsctl slapd-HOME-FAZANT-NET get-nsstate
Replica
DN: cn=replica,cn=dc\3dhome\2cdc\3dfazant\2cdc\3dnet,cn=mappi
ng tree,cn=config
Replica Suffix: dc=home,dc=fazant,dc=net
Replica ID: 21
Gen Time: 1627578955
Gen Time String: Thu Jul 29 19:15:55 2021
Gen as CSN: 6102e24b000400210000
Local Offset: 0
Local Offset String: 0 seconds
Remote Offset: 591807
Remote Offset String: 6 days, 20 hours, 23 minutes, 27 seconds
Time Skew: 591807
Time Skew String: 6 days, 20 hours, 23 minutes, 27 seconds
Seq Num: 4
System Time: Thu Jul 29 19:17:08 2021
Diff in Seconds: 73
Diff in days/secs: 0:73
Endian: Little Endian
Replica DN: cn=replica,cn=o\3dipaca,cn=mapping tree,cn=config
Replica Suffix: o=ipaca
Replica ID: 22
Gen Time: 1627578483
Gen Time String: Thu Jul 29 19:08:03 2021
Gen as CSN: 6102e073000000220000
Local Offset: 0
Local Offset String: 0 seconds
Remote Offset: 81231
Remote Offset String: 22 hours, 33 minutes, 51 seconds
Time Skew: 81231
Time Skew String: 22 hours, 33 minutes, 51 seconds
Seq Num: 0
System Time: Thu Jul 29 19:17:08 2021
Diff in Seconds: 545
Diff in days/secs: 0:545
Endian: Little Endian
I have no idea how to solve this issue. Apparently my google-fu is not
strong enough to find a solution. Can you guys please give me some
hints?
Thanks. Louis