Thank you for the help Flo. Doing the ipa-csreplica-manage re-initialize corrected the
issue I was seeing.
Sincerely,
—
Bob Jones
Lead Linux Services Engineer
ITS ECP - Linux Services
On Nov 20, 2019, at 6:54 AM, Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
On 11/19/19 10:04 PM, Jones, Bob (rwj5d) via FreeIPA-users wrote:
> Hello,
> We have a 3 node multi-master IPA setup. These are running on Red Hat Enterprise
Linux Server release 7.7 (Maipo) and all are version:
> Name : ipa-server
> Arch : x86_64
> Version : 4.6.5
> Release : 11.el7_7.3
> Starting yesterday, we are getting the following messages approximately every 3
seconds from lidm01:
> [19/Nov/2019:15:48:24.221023177 -0500] - ERR -
agmt="cn=caTolidm02.idm.domain.edu" (lidm02:389) - clcache_load_buffer -
Can't locate CSN 5dd2adc0000100070000 in the changelog (DB rc=-30988). If replication
stops, the consumer may need to be reinitialized.
> [19/Nov/2019:15:48:24.222186079 -0500] - ERR - NSMMReplicationPlugin - send_updates -
agmt="cn=caTolidm02.idm.domain.edu" (lidm02:389): Missing data encountered. If
the error persists the replica must be reinitialized.
> [19/Nov/2019:15:48:25.229931823 -0500] - ERR -
agmt="cn=caTolidm03.idm.domain.edu" (lidm03:389) - clcache_load_buffer -
Can't locate CSN 5dd2adc0000100070000 in the changelog (DB rc=-30988). If replication
stops, the consumer may need to be reinitialized.
> [19/Nov/2019:15:48:25.231001956 -0500] - ERR - NSMMReplicationPlugin - send_updates -
agmt="cn=caTolidm03.idm.domain.edu" (lidm03:389): Missing data encountered. If
the error persists the replica must be reinitialized.
Hi,
there are 2 different suffixes managed by IPA when it is deployed with an embedded CA:
- dc=domain,dc=com (replace with your actual domain name): this one stores the user /
host / service entries and most of IPA objects
- o=ipaca: this one is used by PKI server to store the certificate requests, the
certificates, etc...
Each suffix has his own replication agreements with other servers.
The command ipa-replica-manage re-initialize applies only to the dc=domain,dc=com suffix.
To re-initialize the o=ipaca suffix, the command ipa-csreplica-manage re-initialize must
be used.
Hope this clarifies,
flo
> There are no error messages on lidm02 or lidm03. I ran the command
'ipa-replica-manage re-initalize --from lidm01.idm.domain.edu’ on both lidm02 and
lidm03. When that did not change anything I ran the command 'ipa-replica-manage
re-initalize --from lidm02.idm.domain.edu’ on lidm01. This did not change anything
either. I have run restart-dirsrv on all 3 idm servers as well.
> Also, here are the ipa-replica-manage list-ruv output on the 3 servers:
> Lidm01:
> Replica Update Vectors:
> lidm01.idm.domain.edu:389: 4
> lidm02.idm.domain.edu:389: 8
> lidm03.idm.domain.edu:389: 5
> Certificate Server Replica Update Vectors:
> lidm01.idm.domain.edu:389: 7
> lidm02.idm.domain.edu:389: 9
> lidm03.idm.domain.edu:389: 6
> Lidm02:
> Replica Update Vectors:
> lidm02.idm.domain.edu:389: 8
> lidm01.idm.domain.edu:389: 4
> lidm03.idm.domain.edu:389: 5
> Certificate Server Replica Update Vectors:
> lidm02.idm.domain.edu:389: 9
> lidm01.idm.domain.edu:389: 7
> lidm03.idm.domain.edu:389: 6
> Lidm03:
> Replica Update Vectors:
> lidm03.idm.domain.edu:389: 5
> lidm01.idm.domain.edu:389: 4
> lidm02.idm.domain.edu:389: 8
> Certificate Server Replica Update Vectors:
> lidm03.idm.domain.edu:389: 6
> lidm01.idm.domain.edu:389: 7
> lidm02.idm.domain.edu:389: 9
> check_ipa_consistency shows the following:
> +--------------------+----------+----------+----------+-------+
> | FreeIPA servers: | lidm01 | lidm02 | lidm03 | STATE |
> +--------------------+----------+----------+----------+-------+
> | Active Users | 8 | 8 | 8 | OK |
> | Stage Users | 0 | 0 | 0 | OK |
> | Preserved Users | 0 | 0 | 0 | OK |
> | Hosts | 93 | 93 | 93 | OK |
> | Services | 13 | 13 | 13 | OK |
> | User Groups | 89 | 89 | 89 | OK |
> | Host Groups | 15 | 15 | 15 | OK |
> | Netgroups | 14 | 14 | 14 | OK |
> | HBAC Rules | 41 | 41 | 41 | OK |
> | SUDO Rules | 28 | 28 | 28 | OK |
> | DNS Zones | 0 | 0 | 0 | OK |
> | Certificates | 27 | 27 | 27 | OK |
> | LDAP Conflicts | 0 | 0 | 0 | OK |
> | Ghost Replicas | 0 | 0 | 0 | OK |
> | Anonymous BIND | ON | ON | ON | OK |
> | Microsoft ADTrust | True | True | True | OK |
> | Replication Status | lidm02 0 | lidm03 0 | lidm02 0 | OK |
> | | lidm03 0 | lidm01 0 | lidm01 0 | |
> +--------------------+----------+----------+----------+-------+
> At this point I’m not sure what to do next as most references to problems like this
that I could find were solved with the re-initialize of the replication agreements. I
appreciate any help anyone can provide.
> Thanks,
> —
> Bob Jones
> Lead Linux Services Engineer
> ITS ECP - Linux Services
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...