Hi,

At first look, I would say svgipa02 fails trigger its total update from svgipa01 because ipa02 fails authenticate on ipa01. Are the logs from ipa02 ? if it is, it shows that ipa01 did not even try to reinit it. Could you send the DS access/errors logs from both ipa01 and ipa02 at the period of time when you run 'ipa-replica-manage re-initialize' ?

best regards thierry On 10/15/2018 10:42 AM, Karl Dag Gursli via FreeIPA-users wrote:

Hi

We experienced issues with one of our IPA server(svgipa02) as it did not receive updates. It was the decided to run on svgipa02

ipa-replicate-manage re-initialize --from=svgipa01

[root@svgipa02 slapd-NO-EP-CORP-LOCAL]# date; ipa-replica-manage re-initialize --from=svgipa01.no.ep.corp.local;date

Mon Oct 15 10:33:26 CEST 2018

Directory Manager password:

Update in progress, 15 seconds elapsed

[ldaps://svgipa01.no.ep.corp.local:636] reports: Update failed! Status: [49  - LDAP error: Invalid credentials]

Mon Oct 15 10:33:52 CEST 2018

[root@svgipa02 slapd-NO-EP-CORP-LOCAL]#

From the dirsrv errors log

[15/Oct/2018:10:33:34.192011467 +0200] - DEBUG - schema-compat-plugin

• searching from "cn=mapping tree,cn=config" for

"(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))" with scope 2 (sub)

[15/Oct/2018:10:33:34.192823822 +0200] - DEBUG - cos-plugin - cos_cache_vattr_types - Failed to get class of service reference

[15/Oct/2018:10:33:34.193697399 +0200] - DEBUG - schema-compat-plugin

• searching from "cn=schema" for "(objectClass=*)" with scope 0 (base)

[15/Oct/2018:10:33:34.456582623 +0200] - DEBUG - schema-compat-plugin

• searching from "cn=mapping tree,cn=config" for

"(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))" with scope 2 (sub)

[15/Oct/2018:10:33:34.457479057 +0200] - DEBUG - cos-plugin - cos_cache_vattr_types - Failed to get class of service reference

[15/Oct/2018:10:33:34.736019484 +0200] - DEBUG - schema-compat-plugin

• searching from "cn=mapping tree,cn=config" for

"(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))" with scope 2 (sub)

[15/Oct/2018:10:33:34.736561662 +0200] - DEBUG - cos-plugin - cos_cache_vattr_types - Failed to get class of service reference

The procedure did not finish and svgipa02 was left in an empty state

What is the producedure to solve this issue?

rgds

Karl Dag

---

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...