Hi Louis,
So these time skew errors typically happen when the system clock is
adjusted. Technically nothing is broken and replication is working, but
if the time skew continues to "increase" it will cause problems
eventually...
Out of curiosity, were any of these systems running on AWS?
Anyway to reset the CSN generators/timeskew there is this doc:
https://www.port389.org/docs/389ds/howto/howto-fix-and-reset-time-skew.html
If your time skew is not growing, and you don't want to go through the
painful process of fixing it as described in the link above, you could
just disable time skew as mentioned in the healthcheck report, and
ignore these healthcheck warnings (for now healthcheck will still report
skew errors even if nsslapd-ignore-time-skew is off).
Mark
On 7/29/21 1:29 PM, Louis Lagendijk via FreeIPA-users wrote:
Some time ago I hosed my freeipa setup (RHEL8, 3 servers), probably
by
starting yum update pretty much at the same time, without realizing
that it would be better to spread it out a bit. This was at the time I
got the RHEL 8.4 updates.
One server seemed pretty messed up, so I deleted it from the topology
and re-executed the ipa-replica-install.
I deleted some duplicates from the replication, manally fixed the
password issue from
https://github.com/dogtagpki/pki/issues/3650
on the re-installed server.
ipa-healthcheck now reports:
[root@ipa1 ipa-tools]# ipa-healthcheck --failures-only --output-type
human
CRITICAL: ipahealthcheck.ds.dse.DSECheck.DSSKEWLE0003: The time skew is
over 24 hours. Setting nsslapd-ignore-time-skew
to "on" on each replica will allow replication to continue, but if the
time skew continues to increase other serious replication problems can
occur.
ERROR: ipahealthcheck.ds.dse.DSECheck.DSSKEWLE0002: The time skew is
over 12 hours. If this time skew continues to increase
to 24 hours then replication can potentially stop working. Please
continue to
monitor the time skew offsets for increasing values. Setting nsslapd-
ignore-time-skew
to "on" on each replica will allow replication to continue, but if the
time skew
continues to increase other more serious replication problems can
occur.
I got the following from ds389:
[root@ipa1 ipa-tools]# dsctl slapd-HOME-FAZANT-NET get-nsstate
Replica
DN: cn=replica,cn=dc\3dhome\2cdc\3dfazant\2cdc\3dnet,cn=mappi
ng tree,cn=config
Replica Suffix: dc=home,dc=fazant,dc=net
Replica ID: 21
Gen Time: 1627578955
Gen Time String: Thu Jul 29 19:15:55 2021
Gen as CSN: 6102e24b000400210000
Local Offset: 0
Local Offset String: 0 seconds
Remote Offset: 591807
Remote Offset String: 6 days, 20 hours, 23 minutes, 27 seconds
Time Skew: 591807
Time Skew String: 6 days, 20 hours, 23 minutes, 27 seconds
Seq Num: 4
System Time: Thu Jul 29 19:17:08 2021
Diff in Seconds: 73
Diff in days/secs: 0:73
Endian: Little Endian
Replica DN: cn=replica,cn=o\3dipaca,cn=mapping tree,cn=config
Replica Suffix: o=ipaca
Replica ID: 22
Gen Time: 1627578483
Gen Time String: Thu Jul 29 19:08:03 2021
Gen as CSN: 6102e073000000220000
Local Offset: 0
Local Offset String: 0 seconds
Remote Offset: 81231
Remote Offset String: 22 hours, 33 minutes, 51 seconds
Time Skew: 81231
Time Skew String: 22 hours, 33 minutes, 51 seconds
Seq Num: 0
System Time: Thu Jul 29 19:17:08 2021
Diff in Seconds: 545
Diff in days/secs: 0:545
Endian: Little Endian
I have no idea how to solve this issue. Apparently my google-fu is not
strong enough to find a solution. Can you guys please give me some
hints?
Thanks. Louis
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
--
Directory Server Development Team