On 22/10/2018 21:27, Florence Blanc-Renaud wrote:
On 10/22/18 2:10 PM, Roderick Johnstone via FreeIPA-users wrote:
> This is ipa-server-4.5.4-10.el7_5.4.4.x86_64 on RHEL7.5.
> I've got four preserved accounts (out of a few hundred preserved
> On two of the servers they are showing up correctly as preserved with
> this command:
> ipa user-show <username>.
> On the third server the same command shows the users with the
> preserved attribute set to false.
> Based on a few tests changing (other) accounts it seems that
> replication is generally working fine between all the servers.
> 1) The ipa_check_consistency script is showing all three servers with
> the same (correct) number of preserved and active users and is showing
> a good replication status for all server replication agreements.
> So its not showing fewer preserved accounts on one server correctly.
> 2) I'm not seeing any replication conflicts on any of the servers
> through commands like this:
> # ldapsearch -x -D "cn=directory manager" -W -b
> "nsds5ReplConflict=*" \* nsds5ReplConflict
which version of 389-ds is installed? In recent versions (>= 184.108.40.206,
please see ticket 49043 ), you need to use the following search to
retrieve the conflict entries:
ldapsearch -x -D "cn=Directory Manager" -W -b "dc=example,dc=com"
"(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" \* nsds5ReplConflict
(without objectclass=ldapsubentry, the search won't return any result).
Thanks for the info here. We are on: 389-ds-base-220.127.116.11-28.el7_5.x86_64
so indeed need the new command to see replication conflicts.
But, even with that I'm not seeing any conflicts. I've run it on each
server (with my real domain) and still just get:
[root@calxw ~]# ldapsearch -x -D "cn=Directory Manager" -W -b
Enter LDAP Password:
# extended LDIF
# base <dc=example,dc=com> with scope subtree
# filter: (&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))
# requesting: * nsds5ReplConflict
# search result
result: 0 Success
# numResponses: 1
So, I'm still confused as to why one of my servers is out of sync with
the other two and yet there are apparently no replication conflicts showing.
Would still appreciate advice on the best way to resolve this when its
more obvious whats going on.
> Enter LDAP Password:
> # extended LDIF
> # LDAPv3
> # base <dc=example,dc=com> with scope subtree
> # filter: nsds5ReplConflict=*
> # requesting: * nsds5ReplConflict
> # search result
> search: 2
> result: 0 Success
> # numResponses: 1
> 3) The dirsrv error log on server with the users not showing as
> preserved is showing the following entries from last May:
> [11/May/2018:10:09:31.330807982 +0100] - ERR - managed-entries-plugin
> - mep_mod_post_op - Unable to find config for origin entry
> [11/May/2018:10:09:36.294657019 +0100] - ERR - NSMMReplicationPlugin -
> write_changelog_and_ruv - Can't add a change for
> uid=<user>,cn=users,cn=accounts,dc=example,dc=com (uniqid:
> f132de25-54fa11e8-b4d6ec15-cd33af38, optype: 64) to changelog csn
> I'd appreciate any thoughts as to why there might be an inconsistency
> between servers despite there apparently being no replication
> conflicts and no indication in the ipa_check_consistency script output.
> What might be the best way to resolve this inconsistency between servers?
> Roderick Johnstone
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: