I've also just realized that replication appears to have ceased; I have entries in some IPA servers but not all.

[root@zsipa ~]# ipa-replica-manage list
Directory Manager password:

zsipa.damascusgrp.com: master
zsipa2.damascusgrp.com: master
zsipa3.damascusgrp.com: master
[root@zsipa ~]# ipa-replica-manage list zsipa.damascusgrp.com
Directory Manager password:

zsipa3.damascusgrp.com: replica
  last init status: None
  last init ended: 1970-01-01 00:00:00+00:00
  last update status: Error (19) Replication error acquiring replica: Replica has different database generation ID, remote replica may need to be initialized (RUV error)
  last update ended: 1970-01-01 00:00:00+00:00
[root@zsipa ~]#

Only zsipa3 is listed as a replica anywhere, and it's not a functioning one. I can set up replication between zsipa and zsipa2, but is there a good way to bring zsipa3 back in line as well?

The background is that we attempted to do a rolling update of our IPA servers by bringing in a new server, zsipa2, and then upgrading each of the other two from Fedora to Centos 7 and then initialized them as replicas of zsipa2. But apparently, this didn't work as we had thought. So add replication errors to the certificate issue I'm still trying to run to ground.


--
Bret Wortman
Damascus Products
ph/fax: 1-855-644-2783
Wrap Buddies now available for preorder!