Hi
This is ipa-server-4.5.4-10.el7_5.4.4.x86_64 on RHEL7.5.
I've got four preserved accounts (out of a few hundred preserved accounts).
On two of the servers they are showing up correctly as preserved with this command: ipa user-show <username>.
On the third server the same command shows the users with the preserved attribute set to false.
Based on a few tests changing (other) accounts it seems that replication is generally working fine between all the servers.
But:
1) The ipa_check_consistency script is showing all three servers with the same (correct) number of preserved and active users and is showing a good replication status for all server replication agreements.
So its not showing fewer preserved accounts on one server correctly.
2) I'm not seeing any replication conflicts on any of the servers through commands like this:
# ldapsearch -x -D "cn=directory manager" -W -b "dc=example,dc=com" "nsds5ReplConflict=*" * nsds5ReplConflict Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: nsds5ReplConflict=* # requesting: * nsds5ReplConflict #
# search result search: 2 result: 0 Success
# numResponses: 1
3) The dirsrv error log on server with the users not showing as preserved is showing the following entries from last May:
[11/May/2018:10:09:31.330807982 +0100] - ERR - managed-entries-plugin - mep_mod_post_op - Unable to find config for origin entry "uid=<user>,cn=deleted users,cn=accounts,cn=provisioning,dc=example,dc=com". [11/May/2018:10:09:36.294657019 +0100] - ERR - NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a change for uid=<user>,cn=users,cn=accounts,dc=example,dc=com (uniqid: f132de25-54fa11e8-b4d6ec15-cd33af38, optype: 64) to changelog csn 5af55dc9000600040000
I'd appreciate any thoughts as to why there might be an inconsistency between servers despite there apparently being no replication conflicts and no indication in the ipa_check_consistency script output.
What might be the best way to resolve this inconsistency between servers?
Thanks
Roderick Johnstone