Trying to understand what appears to be an excessive amount of replication activity.

Running IPA 4.5 on CentOS 7.4

2 IPA hosts, multi-master

about 800-1000 hosts enrolled and maybe 100 users, maybe 20 or 30 who login via ssh keys on a regular basis.

I enabled:

8192 — Replication debugging

So, I'm wondering, "where are all these changes that need to be replicated coming from?"

In 10 minutes I generated almost 40 MB of logs.
about 26,000 modify operations

the vast majority of those are modifications to the enrolled hosts

picking one host and doing a few "ipa host-find gandalf-008.sec.placeiq.net --all" commands on it and it appears the only thing changing is

krblastsuccessfulauth

Simo here https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/3KJL47NCJ3YGJJ3OAF2GLSASTZIOUCOW/

indicates that should not be replicated.


Any ideas, what I might be looking at/for etc?

Thanks !