I've configured FreeIPA with an AD trust that is handling workstation logins at my organization. Things have been going well, but I've noticed a couple of times that the Directory Services process is consuming a lot of CPU. This morning, after receiving reports of users not being able to log in, I ran `ipactl status` which reported Directory Services as STOPPED. I'm looking for help on where to begin with a root cause analysis.
Here is a snippet from /var/log/dirsrv/error that seems to me to indicate a critical error; I just can't decipher what is happening.
***** [16/Oct/2018:22:25:43.562185858 -0500] - ERR - accept_and_configure - PR_Accept() failed, Netscape Portable Runtime error -5971 (Process open FD table is full.) [16/Oct/2018:22:25:43.563825169 -0500] - ERR - ns_handle_new_connection - PR_PROC_DESC_TABLE_FULL_ERROR: File Descriptor exhaustion has occured! Connections will be silently dropped! [16/Oct/2018:22:25:43.565434972 -0500] - ERR - accept_and_configure - PR_Accept() failed, Netscape Portable Runtime error -5971 (Process open FD table is full.) [16/Oct/2018:22:25:43.567125116 -0500] - ERR - ns_handle_new_connection - PR_PROC_DESC_TABLE_FULL_ERROR: File Descriptor exhaustion has occured! Connections will be silently dropped! [16/Oct/2018:22:25:43.568974177 -0500] - ERR - libdb - BDB0060 PANIC: fatal region error detected; run recovery [16/Oct/2018:22:25:43.580095520 -0500] - CRIT - deadlock_threadmain - Serious Error---Failed in deadlock detect (aborted at 0x0), err=-30973 (BDB0087 DB_RUNRECOVERY: Fatal error, run database recovery) *****
Thanks!
On 10/17/18 11:03 AM, Mike Conner via FreeIPA-users wrote:
I've configured FreeIPA with an AD trust that is handling workstation logins at my organization. Things have been going well, but I've noticed a couple of times that the Directory Services process is consuming a lot of CPU. This morning, after receiving reports of users not being able to log in, I ran `ipactl status` which reported Directory Services as STOPPED. I'm looking for help on where to begin with a root cause analysis.
Here is a snippet from /var/log/dirsrv/error that seems to me to indicate a critical error; I just can't decipher what is happening.
[16/Oct/2018:22:25:43.562185858 -0500] - ERR - accept_and_configure - PR_Accept() failed, Netscape Portable Runtime error -5971 (Process open FD table is full.) [16/Oct/2018:22:25:43.563825169 -0500] - ERR - ns_handle_new_connection - PR_PROC_DESC_TABLE_FULL_ERROR: File Descriptor exhaustion has occured! Connections will be silently dropped! [16/Oct/2018:22:25:43.565434972 -0500] - ERR - accept_and_configure - PR_Accept() failed, Netscape Portable Runtime error -5971 (Process open FD table is full.) [16/Oct/2018:22:25:43.567125116 -0500] - ERR - ns_handle_new_connection - PR_PROC_DESC_TABLE_FULL_ERROR: File Descriptor exhaustion has occured! Connections will be silently dropped! [16/Oct/2018:22:25:43.568974177 -0500] - ERR - libdb - BDB0060 PANIC: fatal region error detected; run recovery [16/Oct/2018:22:25:43.580095520 -0500] - CRIT - deadlock_threadmain - Serious Error---Failed in deadlock detect (aborted at 0x0), err=-30973 (BDB0087 DB_RUNRECOVERY: Fatal error, run database recovery)
What version of DS? rpm -qa | grep 389-ds-base
This looks like a known issue, and you can try disabling nunc-stans, and then restart the server:
# ldapmodify -D "cn=directory manager" -W dn: cn=config changetype: modify replace: nsslapd-enable-nunc-stans nsslapd-enable-nunc-stans: off <press enter twice>
Thanks! _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Thank you! The descriptions of the issue that I found do reflect what I experienced: https://pagure.io/389-ds-base/issue/49815 https://bugzilla.redhat.com/show_bug.cgi?id=1605554 DS Version: 389-ds-base-1.3.7.5-24.el7_5.x86_64 I've applied your recommended solution and will report back if the issue resurfaces.
freeipa-users@lists.fedorahosted.org
-
Mark Reynolds -
Mike Conner