Hi,
I had two freeipa replica servers up and running in our german DC for nearly 2 months and this morning out of the blue they stopped working.
Looking at ipactl status, both servers are reporting that their directory service is stopped. Trying to restart ipa only works from 2 minutes to an hour.
Looking at the /var/log/dirsrv/slapd-DOMAIN-COM/errors there's no errors that show up before it crash.
However, looking at /var/log/messages, this lovely segfault show up:
XXXXXX kernel: ns-slapd[17507]: segfault at 8 ip 00007fb99e56149f sp 00007fb96bee83c0 error 4 in libslapd.s o.0.1.0[7fb99e483000+128000]
Out of despair to get production back up and running quickly, I reinstalled one replica...it worked for an hour and came back with the same issue.
We have 6 other freeipa replica running accross 3 different site with zero issues.
We're running CentOS 7.4 with the latest packages, ipa-server-4.5.0-21 & 389-ds-base-1.3.6.1-21.
Any clues why ?
Thanks
On Fri, Nov 24, 2017 at 07:04:10PM -0500, Alexandre Pitre via FreeIPA-users wrote:
Hi,
I had two freeipa replica servers up and running in our german DC for nearly 2 months and this morning out of the blue they stopped working.
Looking at ipactl status, both servers are reporting that their directory service is stopped. Trying to restart ipa only works from 2 minutes to an hour.
Looking at the /var/log/dirsrv/slapd-DOMAIN-COM/errors there's no errors that show up before it crash.
However, looking at /var/log/messages, this lovely segfault show up:
XXXXXX kernel: ns-slapd[17507]: segfault at 8 ip 00007fb99e56149f sp 00007fb96bee83c0 error 4 in libslapd.s o.0.1.0[7fb99e483000+128000]
Out of despair to get production back up and running quickly, I reinstalled one replica...it worked for an hour and came back with the same issue.
We have 6 other freeipa replica running accross 3 different site with zero issues.
We're running CentOS 7.4 with the latest packages, ipa-server-4.5.0-21 & 389-ds-base-1.3.6.1-21.
Any clues why ?
sorry, no clue but on http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes you can see how to get a core dump file. Inspecting this might help to understand what is going wrong.
bye, Sumit
Thanks
-- Alexandre Pitre alexandre.pitre@gmail.com
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
I believe I found the root cause.There are replication conflicts.
ldapsearch -x -D "cn=directory manager" -w password -b "dc=ipa,dc=domain,dc=com" "nsds5ReplConflict=*" * nsds5ReplConflict
# extended LDIF # # LDAPv3 # base <dc=ipa,dc=domain,dc=com> with scope subtree # filter: nsds5ReplConflict=* # requesting: * nsds5ReplConflict #
# oldipaserver + b4066f9e-cf0b11e7-9ad4d14c-07041c4f, ipa.domain.com., dns, t enant.domain.com dn: idnsName=oldipaserver+nsuniqueid=b4066f9e-cf0b11e7-9ad4d14c-07041c4f,id nsname=ipa.domain.com.,cn=dns,dc=ipa,dc=domain,dc=com idnsName: oldipaserver objectClass: idnsRecord objectClass: top aRecord: 10.28.247.230 sSHFPRecord: 1 1 D179038D4D2918411C32C2E6052CBB561050EA48 sSHFPRecord: 1 2 78E7197543306DDA840AFF07296F66CBDA5BCC35A06E7A2E5229FC43 F28A E7EF sSHFPRecord: 3 1 8C9BF123F46F8F65507059F1CE670589B8A7B84A sSHFPRecord: 3 2 B60CE25FE4DB91975EB9055CADE6FF203F1154C6406B5DA6177659DF B88F 0E46 sSHFPRecord: 4 1 2FF7427DE66D360644E2901930F9CA105D47C33F sSHFPRecord: 4 2 98C424319EFF9D8EC8DFD12BB13286FC99F6006873D86739E2AA4A55 4C46 0E04 dNSTTL: 1200 nsds5ReplConflict: namingConflict idnsName=oldipaserver,idnsname=ipa.domain .com.,cn=dns,dc=ipa,dc=domain,dc=com
# HTTP/oldipaserver.ipa.domain.com@ipa.domain.com + aa37478f-cfb111e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/oldipaserver.ipa.domain.com@ipa.domain.com +nsunique id=aa37478f-cfb111e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: c0db959a-cfb1-11e7-8ca5-0050568cb5f0 krbPrincipalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com managedBy: fqdn=oldipaserver.ipa.domain.com,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBFzANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTIyMTgyM DAxWhcNMTkxMTIzMTgyMDAxWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE BAO9EpY9mT/Z4aA4wWse7rak2/Mh0qcAJHK3u5+SEq5eu70b7XAz/ivSOfn4Q/DJW0jJS03GxLCIC NUAMzNINnkhuboKceNL1QDz41Bo19tyujhEQlJcdQVa6K0OM7YuKtsXfhI8g8wrcj53YVJailfoSS iDmvvg/xNJ9P/6WvmvSNZyf7UkXdEM/lAkjEakqM1FPQN1lk/PB10pV6lZzzXSpBCbAU1GuV+srj6 zimvOS/WAgv2cG+iE0mDlfBnW+kqTd/qe5vW914oI4i1x5aLncMkNHsCDzNOBL05UV+Ry/3Un4pdi ZQCZU1BCKSy7hwhu0SgsI5hk5IPte6/aVG8ECAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBTsjF87tMtQQRowrXaotHV5vErhxjCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG50LWlwYS0wMDEudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAmclabyeU4abixWIv6f6gCRgmXdwBzkvAjTxXP jfE6ZMwQUFYaoD71j3AxrPJMHnqtYDvPKkr5vkp0qn8ErxjWEBkFH57q0a8z8bwp9enKL4wTALKrc NoGr0jCLdzR3RWK3+71ITXmWxb1AUsHFq5nuxktKaJC/5QKNQu2REZSscFlbBvI8gema9cjUm0eQ0 iwmSRSPagBWpYowj5eYV6oZBxRR4gtY3QoUKzWelAqPdkqvbF0u96uKfxET/crEqGGwJdA7xqLm8g S655zkM9b/++exlEFCp2cIxbP51Pinli+FRAQv9Bd75DxrXO6FzAU7UfjChzTSfk3LRwpWG8aA== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/oldipaserver.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com
# HTTP/ipaserver002.ipa.domain.com@ipa.domain.com + 691465b4-d08d11e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver002.ipa.domain.com@ipa.domain.com +nsunique id=691465b4-d08d11e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 8d595d9c-d08d-11e7-9954-0050568cb5f0 krbPrincipalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver002.ipa.domain.com,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBGjANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTIzMjAzM zI0WhcNMTkxMTI0MjAzMzI0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE BALsH9D9LIvvzYThtahRAT3E8QvkZLe/SbMU0P52vC4BVoTCCOYDLo6jCTBd925u0zId20hJx71nC 9wchvP3BLA0JexS8bh7U64u5CSTfLK9EPgsHqJgVve0Jz35KFhgcnOP8GqXvdtu1efMJL0hR4/U50 lftEZdy5cm/TSrJL/DncZ1Srl7hHgYIjRIQ5R8S/Axw5zE3eGd8+WsAVB5gqq4fOLUUsQp88ImUES oYtHHJ1O9s5N/Hz9AAy+TdcKRDj+EEIxoQNUsOms8H7dG6/wFRTb6mq2NBGT9sf2xBW+iUqoKGe0E kd273xqUGbUyJKuhrGRgHnyrai9G27YqulSsCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSsrJU7LDvxTAIbOe1JFI7r6PAcbzCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAyLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG50LWlwYS0wMDIudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAYcv6z2MlwgDOrcF9HHTpQ1e1Xo+aR1kUfyF53 mWTG5FYJ3BJZz00NhzRr16xfs83eFJ6comcJfujQweD2Ojy7d4oMMYDb85+Am132FgpT5V9rcuMenh bmAxwXq/7rXZNJzlni+TcPPpHXKgAkdCep+IKrul6r1Ugykj8mWKl2K/+VJaXt9vCZVZUd5G911lu kLbdFhNLWCkH8ye0WtibOstYi3blSkc3QGt4gCSf0uAe1OiTKMPqpz+uu8rGRpN8bMVmha5JlbE3F 2zEIbP5xjA2sztPeVOBN+YNn6yi7kmhJAgCpMISQ14G5os7ZIrPtNIs9o7BRIrgOuV6W62UuEw== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver002.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com
# HTTP/ipaserver001.ipa.domain.com@ipa.domain.com + f960b202-d14211e7-965fca1d -506f74cb, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver001.ipa.domain.com@ipa.domain.com +nsunique id=f960b202-d14211e7-965fca1d-506f74cb,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: fe68c03a-d142-11e7-b3c2-0050569a7366 krbPrincipalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver001.ipa.domain.com,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE5jCCA86gAwIBAgIED/0ABTANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQK Ew1URU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTI0M TgxMjEyWhcNMTkxMTI1MTgxMjEyWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB 1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQo CggEBAOE+S90kJ+1zq0Ray0rOYZQn2Rve+Loi8Jy65UUR93CD8XrjHcptPOl3Nha7OM4vodABHgEH 2by8Qzza4FZkIvE+HbPqsHVATPcU9/WBsbXcCY5f1oD4vnu/Crzc9QYRJrMCoukELLVW7EntPVfZv 4/TXDIwE5BDiu4b623+JPjZ0sqHyUCKjcWiIexkp0c9TyeV3m1yYTzhA7TXxhCtgkhZCaPRnDFU8G NBy3upl1ethbPv65e4zwWAniulmIzpZ8jlMLbzeErTXbxAP2vaxpANJHRepd3hexCNRBpO+nOIHAj GSdiJhN/JpFS1g6ldTeI+rMxv0hqRQgUiC9CCxgkCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiW a54LyD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwY S1jYS50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQ UFBwMBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3M uaW8vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwV Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBQW9TaRJG4IdTlAkGGOleOAqYIL3TCBvQYDV R0RBIG1MIGygh1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMME hUVFAvcm8xLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgK gRTBDoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybzEtdG50LWlwYS0wMDEu dGVuYW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAeEtevJdlJK/EkMeE4lUFk5eMX/uhu8Ewr RZDpnpqMIp776QH64qiJTc4ZcA0ggrNePb1T92TLcOo4wW9N7Ih6/sgj7zhGS62EfzhRPsMoJayZh ZhPHkqFEI9UsVKMayBZTnvAB8pgkrmumh7S2rgp4alUSGSPhRMQ2GWEvI8554F2bF4q0wAl0S/qNX UdFtS76W2OATcZZyYL8ufQfYo6tcFyFTl6KiMPtP8jKi6v3pDjVCR1eHK0YKswBaHCsl9Wlzlnz9U Xbt9a/d0x+c1RO9sRkD4RbCQVaWgdlTyllsH66/J9QtG1AbFFidPt8JtxkOXjZ3J9oi/tiLoMUN5i A== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=http/ipaserver001.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com
# HTTP/ipaserver003.ipa.domain.com@ipa.domain.com + 5fffd19d-d21011e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver003.ipa.domain.com@ipa.domain.com +nsunique id=5fffd19d-d21011e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 78d35f24-d210-11e7-b055-0050568cb5f0 krbPrincipalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver003.ipa.domain.com,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBHjANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTI1MTg0M zA0WhcNMTkxMTI2MTg0MzA0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1ybz EtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE BANFhBMKFTE4xsmcld+NTEDgr5RyeHiQoVi695Lxh7LmT9ccBNPtZG6/4sceGQpcyJpdoZTFMxrFp 97ZgfZwtT09uJxGtTIHVFctGRACm5E4+NlW2MCSwsod9OXH4P8QTCMdAapmMWynKnFx+B3v7TJfES 7WRP7GkcHofFSVtN3X1bUpfk4Co+1mDV85q7QFTmPaMzcREWmCr+DCwG3cy+YZDIbsih07FkJeaTy lzIXvOEbQ7UaoZtMndH+8D/E4VboCV1x0Is0bjuCQqFcEiIQBgBHTPtXkMA5we+ZK4tsUgl1A0As7 Df1oFlISnj2JwrkX6Ox8y7acIPOgnD6ecxesCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSazpOqyaJc6zL8ZCqZLPIsmpT91jCBvQYDVR0RB IG1MIGygh1ybzEtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF Avcm8xLXRudC1pcGEtMDAzLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybzEtdG50LWlwYS0wMDMudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAVlKBrfmIUBVU129Dd96328+nBRAmQhEcs5//Y C4uF5AQ7a54f9kUWhaRj504E8gXX/Ffen2q3YxXRAl0KKhZDrOCYjjyJE7RfBTv4oNMG48PzoymvX RW/e7LWE1x2NtkyXt0MNKpEFFTWVYRq7Fz8KZqnasV48o6NW2js0ZRS3aR8F/SUqTT7hzSo8mTdFe 07L/MMtImQBFOB7qPZePZMABtkI4ot7sMMB9/tTgvX5bRkKrukGGa08qPBU9mM72V8BURnwKLzWcL 3EHcomjPmZ4Q83XhxeWBDhxC4dtLQ3LvQJEpxPAU/TFiBMxCEChnpWT+EG7tflVKft4nbdYFq3w== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver003.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com
# search result search: 2 result: 0 Success
# numResponses: 6 # numEntries: 5
I uninstalled "oldipaserver" but I still get the replication conflict.
I try to use ldapdelete but it keep on complaining about the syntax.
Any suggestions?
Thanks, Alex
On Sat, Nov 25, 2017 at 11:57 AM, Sumit Bose via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
On Fri, Nov 24, 2017 at 07:04:10PM -0500, Alexandre Pitre via FreeIPA-users wrote:
Hi,
I had two freeipa replica servers up and running in our german DC for nearly 2 months and this morning out of the blue they stopped working.
Looking at ipactl status, both servers are reporting that their directory service is stopped. Trying to restart ipa only works from 2 minutes to an hour.
Looking at the /var/log/dirsrv/slapd-DOMAIN-COM/errors there's no errors that show up before it crash.
However, looking at /var/log/messages, this lovely segfault show up:
XXXXXX kernel: ns-slapd[17507]: segfault at 8 ip 00007fb99e56149f sp 00007fb96bee83c0 error 4 in libslapd.s o.0.1.0[7fb99e483000+128000]
Out of despair to get production back up and running quickly, I
reinstalled
one replica...it worked for an hour and came back with the same issue.
We have 6 other freeipa replica running accross 3 different site with
zero
issues.
We're running CentOS 7.4 with the latest packages, ipa-server-4.5.0-21 & 389-ds-base-1.3.6.1-21.
Any clues why ?
sorry, no clue but on http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes you can see how to get a core dump file. Inspecting this might help to understand what is going wrong.
bye, Sumit
Thanks
-- Alexandre Pitre alexandre.pitre@gmail.com
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.
fedorahosted.org _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
I managed to remove the replication conflicts but the orignal issue persist. I found a couple of triggers that crash the directory service, regardless of the freeipa server location. Here are the triggers:
- Deleting a host that exist in freeipa but no longer exist in our infrastructure - Deleting the same host from an hostgroup - Re-building the auto membership of the hosts
What worry me the most is that I can't even delete the "dead hosts" from the ldap backend cn=computers OU...it crash the directory service as well.
Attached you'll find the stack trace generated from a core dump.
Please help.
Thanks
On Sun, Nov 26, 2017 at 11:06 PM, Alexandre Pitre <alexandre.pitre@gmail.com
wrote:
I believe I found the root cause.There are replication conflicts.
ldapsearch -x -D "cn=directory manager" -w password -b "dc=ipa,dc=domain,dc=com" "nsds5ReplConflict=*" * nsds5ReplConflict
# extended LDIF # # LDAPv3 # base <dc=ipa,dc=domain,dc=com> with scope subtree # filter: nsds5ReplConflict=* # requesting: * nsds5ReplConflict #
# oldipaserver + b4066f9e-cf0b11e7-9ad4d14c-07041c4f, ipa.domain.com., dns, t enant.domain.com dn: idnsName=oldipaserver+nsuniqueid=b4066f9e-cf0b11e7- 9ad4d14c-07041c4f,id nsname=ipa.domain.com.,cn=dns,dc=ipa,dc=domain,dc=com idnsName: oldipaserver objectClass: idnsRecord objectClass: top aRecord: 10.28.247.230 sSHFPRecord: 1 1 D179038D4D2918411C32C2E6052CBB561050EA48 sSHFPRecord: 1 2 78E7197543306DDA840AFF07296F66CBDA5BCC35A06E7A2E5229FC43 F28A E7EF sSHFPRecord: 3 1 8C9BF123F46F8F65507059F1CE670589B8A7B84A sSHFPRecord: 3 2 B60CE25FE4DB91975EB9055CADE6FF203F1154C6406B5DA6177659DF B88F 0E46 sSHFPRecord: 4 1 2FF7427DE66D360644E2901930F9CA105D47C33F sSHFPRecord: 4 2 98C424319EFF9D8EC8DFD12BB13286FC99F6006873D86739E2AA4A55 4C46 0E04 dNSTTL: 1200 nsds5ReplConflict: namingConflict idnsName=oldipaserver, idnsname=ipa.domain .com.,cn=dns,dc=ipa,dc=domain,dc=com
# HTTP/oldipaserver.ipa.domain.com@ipa.domain.com + aa37478f-cfb111e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/oldipaserver.ipa.domain.com@ipa.domain.com +nsunique id=aa37478f-cfb111e7-9ad4d14c-07041c4f,cn=services, cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: c0db959a-cfb1-11e7-8ca5-0050568cb5f0 krbPrincipalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com managedBy: fqdn=oldipaserver.ipa.domain.com,cn=computers,cn=accounts, dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBFzANBgkqhk iG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkw HhcNMTcxMTIyMTgyM DAxWhcNMTkxMTIzMTgyMDAxWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPM SYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQ ADggEPADCCAQoCggE BAO9EpY9mT/Z4aA4wWse7rak2/Mh0qcAJHK3u5+SEq5eu70b7XAz/ ivSOfn4Q/DJW0jJS03GxLCIC NUAMzNINnkhuboKceNL1QDz41Bo19tyujhEQlJcdQVa6K0OM7YuKtsXfhI8g 8wrcj53YVJailfoSS iDmvvg/xNJ9P/6WvmvSNZyf7UkXdEM/lAkjEakqM1FPQN1lk/ PB10pV6lZzzXSpBCbAU1GuV+srj6 zimvOS/WAgv2cG+iE0mDlfBnW+kqTd/qe5vW914oI4i1x5aLncMkNHsCDzNOB L05UV+Ry/3Un4pdi ZQCZU1BCKSy7hwhu0SgsI5hk5IPte6/aVG8ECAwEAAaOCAe4wggHqMB8GA1Ud IwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYj aHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQ UFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLn RlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTE eMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBTsjF87tMtQQRowrXaotHV5 vErhxjCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEEA YI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6 BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tb zItdG50LWlwYS0wMDEudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAmclabyeU4abixWIv6f6g CRgmXdwBzkvAjTxXP jfE6ZMwQUFYaoD71j3AxrPJMHnqtYDvPKkr5vkp0qn8ErxjWEBkFH57q0a8z 8bwp9enKL4wTALKrc NoGr0jCLdzR3RWK3+71ITXmWxb1AUsHFq5nuxktKaJC/ 5QKNQu2REZSscFlbBvI8gema9cjUm0eQ0 iwmSRSPagBWpYowj5eYV6oZBxRR4gtY3QoUKzWelAqPdkqvbF0u96uKfxET/ crEqGGwJdA7xqLm8g S655zkM9b/++exlEFCp2cIxbP51Pinli+FRAQv9Bd75DxrXO6FzAU7UfjChzTSf k3LRwpWG8aA== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/oldipaserver.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc= ipa,dc=domain,dc=com
# HTTP/ipaserver002.ipa.domain.com@ipa.domain.com + 691465b4-d08d11e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver002.ipa.domain.com@ipa.domain.com +nsunique id=691465b4-d08d11e7-9ad4d14c-07041c4f,cn=services, cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 8d595d9c-d08d-11e7-9954-0050568cb5f0 krbPrincipalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver002.ipa.domain.com,cn=computers,cn=accounts, dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBGjANBgkqhk iG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkw HhcNMTcxMTIzMjAzM zI0WhcNMTkxMTI0MjAzMzI0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPM SYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQ ADggEPADCCAQoCggE BALsH9D9LIvvzYThtahRAT3E8QvkZLe/SbMU0P52vC4BVoTCCOYDLo6jCTBd92 5u0zId20hJx71nC 9wchvP3BLA0JexS8bh7U64u5CSTfLK9EPgsHqJgVve0Jz35KFhgcnOP8GqXv dtu1efMJL0hR4/U50 lftEZdy5cm/TSrJL/DncZ1Srl7hHgYIjRIQ5R8S/Axw5zE3eGd8+ WsAVB5gqq4fOLUUsQp88ImUES oYtHHJ1O9s5N/Hz9AAy+TdcKRDj+EEIxoQNUsOms8H7dG6/ wFRTb6mq2NBGT9sf2xBW+iUqoKGe0E kd273xqUGbUyJKuhrGRgHnyrai9G27YqulSsCAwEAAaOCAe4wggHqMB8GA1U dIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYj aHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQ UFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLn RlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTE eMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSsrJU7LDvxTAIbOe1JFI7r 6PAcbzCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pb6BABgorBgEEA YI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAyLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6 BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tb zItdG50LWlwYS0wMDIudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAYcv6z2MlwgDOrcF9HHTp Q1e1Xo+aR1kUfyF53 mWTG5FYJ3BJZz00NhzRr16xfs83eFJ6comcJfujQweD2Ojy7d4oMMYDb85+ Am132FgpT5V9rcuMenh bmAxwXq/7rXZNJzlni+TcPPpHXKgAkdCep+IKrul6r1Ugykj8mWKl2K/+ VJaXt9vCZVZUd5G911lu kLbdFhNLWCkH8ye0WtibOstYi3blSkc3QGt4gCSf0uAe1OiTKMPqpz+ uu8rGRpN8bMVmha5JlbE3F 2zEIbP5xjA2sztPeVOBN+YNn6yi7kmhJAgCpMISQ14G5os7ZIrP tNIs9o7BRIrgOuV6W62UuEw== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver002.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc= ipa,dc=domain,dc=com
# HTTP/ipaserver001.ipa.domain.com@ipa.domain.com + f960b202-d14211e7-965fca1d -506f74cb, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver001.ipa.domain.com@ipa.domain.com +nsunique id=f960b202-d14211e7-965fca1d-506f74cb,cn=services, cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: fe68c03a-d142-11e7-b3c2-0050569a7366 krbPrincipalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver001.ipa.domain.com,cn=computers,cn=accounts, dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE5jCCA86gAwIBAgIED/0ABTANBgkqhkiG9w0BAQsFADA4MRYw FAYDVQQK Ew1URU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3Jp dHkwHhcNMTcxMTI0M TgxMjEyWhcNMTkxMTI1MTgxMjEyWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTL klPMSYwJAYDVQQDDB 1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQ EBBQADggEPADCCAQo CggEBAOE+S90kJ+1zq0Ray0rOYZQn2Rve+Loi8Jy65UUR93CD8XrjHcptPOl3Nha 7OM4vodABHgEH 2by8Qzza4FZkIvE+HbPqsHVATPcU9/WBsbXcCY5f1oD4vnu/ Crzc9QYRJrMCoukELLVW7EntPVfZv 4/TXDIwE5BDiu4b623+JPjZ0sqHyUCKjcWiIexkp0c9TyeV3m 1yYTzhA7TXxhCtgkhZCaPRnDFU8G NBy3upl1ethbPv65e4zwWAniulmIzpZ8jlMLbzeErTXbxAP2vaxpANJHRepd 3hexCNRBpO+nOIHAj GSdiJhN/JpFS1g6ldTeI+rMxv0hqRQgUiC9CCxgkCAwEAAaOCAe 4wggHqMB8GA1UdIwQYMBaAFNiW a54LyD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcw AYYjaHR0cDovL2lwY S1jYS50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/ BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQ UFBwMBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLW NhLnRlbmFudC55Y3M uaW8vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGF jYTEeMBwGA1UEAwwV Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBQW9TaRJG4IdTlAkGGO leOAqYIL3TCBvQYDV R0RBIG1MIGygh1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorB gEEAYI3FAIDoDIMME hUVFAvcm8xLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy 5JT6BPBgYrBgEFAgK gRTBDoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1yb zEtdG50LWlwYS0wMDEu dGVuYW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAeEtevJdlJK/ EkMeE4lUFk5eMX/uhu8Ewr RZDpnpqMIp776QH64qiJTc4ZcA0ggrNePb1T92TLcOo4wW9N7Ih6/ sgj7zhGS62EfzhRPsMoJayZh ZhPHkqFEI9UsVKMayBZTnvAB8pgkrmumh7S2rgp4alUSGSPhRMQ2GWEvI855 4F2bF4q0wAl0S/qNX UdFtS76W2OATcZZyYL8ufQfYo6tcFyFTl6KiMPtP8jKi6v3pDjVCR1eHK0YK swBaHCsl9Wlzlnz9U Xbt9a/d0x+c1RO9sRkD4RbCQVaWgdlTyllsH66/J9QtG1AbFFidPt8JtxkOXjZ3J9oi/ tiLoMUN5i A== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=http/ipaserver001.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc= ipa,dc=domain,dc=com
# HTTP/ipaserver003.ipa.domain.com@ipa.domain.com + 5fffd19d-d21011e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver003.ipa.domain.com@ipa.domain.com +nsunique id=5fffd19d-d21011e7-9ad4d14c-07041c4f,cn=services, cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 78d35f24-d210-11e7-b055-0050568cb5f0 krbPrincipalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver003.ipa.domain.com,cn=computers,cn=accounts, dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBHjANBgkqhk iG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkw HhcNMTcxMTI1MTg0M zA0WhcNMTkxMTI2MTg0MzA0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPM SYwJAYDVQQDDB1ybz EtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQ ADggEPADCCAQoCggE BANFhBMKFTE4xsmcld+NTEDgr5RyeHiQoVi695Lxh7LmT9ccB NPtZG6/4sceGQpcyJpdoZTFMxrFp 97ZgfZwtT09uJxGtTIHVFctGRACm5E4+NlW2MCSwsod9OXH4P8QTCMdAapmMWy nKnFx+B3v7TJfES 7WRP7GkcHofFSVtN3X1bUpfk4Co+1mDV85q7QFTmPaMzcREWmCr+ DCwG3cy+YZDIbsih07FkJeaTy lzIXvOEbQ7UaoZtMndH+8D/E4VboCV1x0Is0bjuCQqFcEiIQBgBHT PtXkMA5we+ZK4tsUgl1A0As7 Df1oFlISnj2JwrkX6Ox8y7acIPOgnD6ecxesCAwEAAaOCAe4wggHqMB8GA1U dIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYj aHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQ UFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLn RlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTE eMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSazpOqyaJc6zL8ZCqZLPIs mpT91jCBvQYDVR0RB IG1MIGygh1ybzEtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pb6BABgorBgEEA YI3FAIDoDIMMEhUVF Avcm8xLXRudC1pcGEtMDAzLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6 BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1yb zEtdG50LWlwYS0wMDMudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAVlKBrfmIUBVU129Dd963 28+nBRAmQhEcs5//Y C4uF5AQ7a54f9kUWhaRj504E8gXX/Ffen2q3YxXRAl0KKhZDrOCYjjyJE7R fBTv4oNMG48PzoymvX RW/e7LWE1x2NtkyXt0MNKpEFFTWVYRq7Fz8KZqnasV48o6NW2js0ZRS3aR8F/ SUqTT7hzSo8mTdFe 07L/MMtImQBFOB7qPZePZMABtkI4ot7sMMB9/tTgvX5bRkKrukGGa08qPBU9mM72V8B URnwKLzWcL 3EHcomjPmZ4Q83XhxeWBDhxC4dtLQ3LvQJEpxPAU/TFiBMxCEChnpWT+ EG7tflVKft4nbdYFq3w== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver003.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc= ipa,dc=domain,dc=com
# search result search: 2 result: 0 Success
# numResponses: 6 # numEntries: 5
I uninstalled "oldipaserver" but I still get the replication conflict.
I try to use ldapdelete but it keep on complaining about the syntax.
Any suggestions?
Thanks, Alex
On Sat, Nov 25, 2017 at 11:57 AM, Sumit Bose via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
On Fri, Nov 24, 2017 at 07:04:10PM -0500, Alexandre Pitre via FreeIPA-users wrote:
Hi,
I had two freeipa replica servers up and running in our german DC for nearly 2 months and this morning out of the blue they stopped working.
Looking at ipactl status, both servers are reporting that their
directory
service is stopped. Trying to restart ipa only works from 2 minutes to
an
hour.
Looking at the /var/log/dirsrv/slapd-DOMAIN-COM/errors there's no
errors
that show up before it crash.
However, looking at /var/log/messages, this lovely segfault show up:
XXXXXX kernel: ns-slapd[17507]: segfault at 8 ip 00007fb99e56149f sp 00007fb96bee83c0 error 4 in libslapd.s o.0.1.0[7fb99e483000+128000]
Out of despair to get production back up and running quickly, I
reinstalled
one replica...it worked for an hour and came back with the same issue.
We have 6 other freeipa replica running accross 3 different site with
zero
issues.
We're running CentOS 7.4 with the latest packages, ipa-server-4.5.0-21 & 389-ds-base-1.3.6.1-21.
Any clues why ?
sorry, no clue but on http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes you can see how to get a core dump file. Inspecting this might help to understand what is going wrong.
bye, Sumit
Thanks
-- Alexandre Pitre alexandre.pitre@gmail.com
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedo
rahosted.org _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedo rahosted.org
-- Alexandre Pitre alexandre.pitre@gmail.com
The crash looks very much like the one found in https://pagure.io/389-ds-base/issue/48894 it is fixed and the code has also been generally improved with: https://pagure.io/389-ds-base/issue/49401
As far as I can see these patches are not in 1.3.6.1-21, they are in upstream 1.3.6.10.
If you cannot get a version containing these patches, you could try to cleanup the entry state information by export/import reinitialize. It would mean on on server export the data to ldif without replication meta data and reimport it. But this changes the data generation and other replicas have to be reinitialized for replication to work again
Ludwig
On 11/28/2017 04:37 AM, Alexandre Pitre via FreeIPA-users wrote:
I managed to remove the replication conflicts but the orignal issue persist. I found a couple of triggers that crash the directory service, regardless of the freeipa server location. Here are the triggers:
- Deleting a host that exist in freeipa but no longer exist in our infrastructure
- Deleting the same host from an hostgroup
- Re-building the auto membership of the hosts
What worry me the most is that I can't even delete the "dead hosts" from the ldap backend cn=computers OU...it crash the directory service as well.
Attached you'll find the stack trace generated from a core dump.
Please help.
Thanks
On Sun, Nov 26, 2017 at 11:06 PM, Alexandre Pitre <alexandre.pitre@gmail.com mailto:alexandre.pitre@gmail.com> wrote:
I believe I found the root cause.There are replication conflicts. ldapsearch -x -D "cn=directory manager" -w password -b "dc=ipa,dc=domain,dc=com" "nsds5ReplConflict=*" \* nsds5ReplConflict # extended LDIF # # LDAPv3 # base <dc=ipa,dc=domain,dc=com> with scope subtree # filter: nsds5ReplConflict=* # requesting: * nsds5ReplConflict # # oldipaserver + b4066f9e-cf0b11e7-9ad4d14c-07041c4f, ipa.domain.com <http://ipa.domain.com>., dns, t enant.domain.com <http://enant.domain.com> dn: idnsName=oldipaserver+nsuniqueid=b4066f9e-cf0b11e7-9ad4d14c-07041c4f,id nsname=ipa.domain.com <http://ipa.domain.com>.,cn=dns,dc=ipa,dc=domain,dc=com idnsName: oldipaserver objectClass: idnsRecord objectClass: top aRecord: 10.28.247.230 sSHFPRecord: 1 1 D179038D4D2918411C32C2E6052CBB561050EA48 sSHFPRecord: 1 2 78E7197543306DDA840AFF07296F66CBDA5BCC35A06E7A2E5229FC43 F28A E7EF sSHFPRecord: 3 1 8C9BF123F46F8F65507059F1CE670589B8A7B84A sSHFPRecord: 3 2 B60CE25FE4DB91975EB9055CADE6FF203F1154C6406B5DA6177659DF B88F 0E46 sSHFPRecord: 4 1 2FF7427DE66D360644E2901930F9CA105D47C33F sSHFPRecord: 4 2 98C424319EFF9D8EC8DFD12BB13286FC99F6006873D86739E2AA4A55 4C46 0E04 dNSTTL: 1200 nsds5ReplConflict: namingConflict idnsName=oldipaserver,idnsname=ipa.domain .com.,cn=dns,dc=ipa,dc=domain,dc=com # HTTP/oldipaserver.ipa.domain.com@ipa.domain.com <mailto:oldipaserver.ipa.domain.com@ipa.domain.com> + aa37478f-cfb111e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com <http://ipa.domain.com> dn: krbprincipalname=HTTP/oldipaserver.ipa.domain.com@ipa.domain.com <mailto:oldipaserver.ipa.domain.com@ipa.domain.com>+nsunique id=aa37478f-cfb111e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: c0db959a-cfb1-11e7-8ca5-0050568cb5f0 krbPrincipalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com <mailto:oldipaserver.ipa.domain.com@ipa.domain.com> managedBy: fqdn=oldipaserver.ipa.domain.com <http://oldipaserver.ipa.domain.com>,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com <mailto:oldipaserver.ipa.domain.com@ipa.domain.com> ipaKrbPrincipalAlias: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com <mailto:oldipaserver.ipa.domain.com@ipa.domain.com> objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBFzANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTIyMTgyM DAxWhcNMTkxMTIzMTgyMDAxWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE BAO9EpY9mT/Z4aA4wWse7rak2/Mh0qcAJHK3u5+SEq5eu70b7XAz/ivSOfn4Q/DJW0jJS03GxLCIC NUAMzNINnkhuboKceNL1QDz41Bo19tyujhEQlJcdQVa6K0OM7YuKtsXfhI8g8wrcj53YVJailfoSS iDmvvg/xNJ9P/6WvmvSNZyf7UkXdEM/lAkjEakqM1FPQN1lk/PB10pV6lZzzXSpBCbAU1GuV+srj6 zimvOS/WAgv2cG+iE0mDlfBnW+kqTd/qe5vW914oI4i1x5aLncMkNHsCDzNOBL05UV+Ry/3Un4pdi ZQCZU1BCKSy7hwhu0SgsI5hk5IPte6/aVG8ECAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBTsjF87tMtQQRowrXaotHV5vErhxjCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG50LWlwYS0wMDEudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAmclabyeU4abixWIv6f6gCRgmXdwBzkvAjTxXP jfE6ZMwQUFYaoD71j3AxrPJMHnqtYDvPKkr5vkp0qn8ErxjWEBkFH57q0a8z8bwp9enKL4wTALKrc NoGr0jCLdzR3RWK3+71ITXmWxb1AUsHFq5nuxktKaJC/5QKNQu2REZSscFlbBvI8gema9cjUm0eQ0 iwmSRSPagBWpYowj5eYV6oZBxRR4gtY3QoUKzWelAqPdkqvbF0u96uKfxET/crEqGGwJdA7xqLm8g S655zkM9b/++exlEFCp2cIxbP51Pinli+FRAQv9Bd75DxrXO6FzAU7UfjChzTSfk3LRwpWG8aA== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/oldipaserver.ipa .domain.com@ipa.domain.com <mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com # HTTP/ipaserver002.ipa.domain.com@ipa.domain.com <mailto:ipaserver002.ipa.domain.com@ipa.domain.com> + 691465b4-d08d11e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com <http://ipa.domain.com> dn: krbprincipalname=HTTP/ipaserver002.ipa.domain.com@ipa.domain.com <mailto:ipaserver002.ipa.domain.com@ipa.domain.com>+nsunique id=691465b4-d08d11e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 8d595d9c-d08d-11e7-9954-0050568cb5f0 krbPrincipalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com <mailto:ipaserver002.ipa.domain.com@ipa.domain.com> managedBy: fqdn=ipaserver002.ipa.domain.com <http://ipaserver002.ipa.domain.com>,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com <mailto:ipaserver002.ipa.domain.com@ipa.domain.com> ipaKrbPrincipalAlias: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com <mailto:ipaserver002.ipa.domain.com@ipa.domain.com> objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBGjANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTIzMjAzM zI0WhcNMTkxMTI0MjAzMzI0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE BALsH9D9LIvvzYThtahRAT3E8QvkZLe/SbMU0P52vC4BVoTCCOYDLo6jCTBd925u0zId20hJx71nC 9wchvP3BLA0JexS8bh7U64u5CSTfLK9EPgsHqJgVve0Jz35KFhgcnOP8GqXvdtu1efMJL0hR4/U50 lftEZdy5cm/TSrJL/DncZ1Srl7hHgYIjRIQ5R8S/Axw5zE3eGd8+WsAVB5gqq4fOLUUsQp88ImUES oYtHHJ1O9s5N/Hz9AAy+TdcKRDj+EEIxoQNUsOms8H7dG6/wFRTb6mq2NBGT9sf2xBW+iUqoKGe0E kd273xqUGbUyJKuhrGRgHnyrai9G27YqulSsCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSsrJU7LDvxTAIbOe1JFI7r6PAcbzCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAyLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG50LWlwYS0wMDIudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAYcv6z2MlwgDOrcF9HHTpQ1e1Xo+aR1kUfyF53 mWTG5FYJ3BJZz00NhzRr16xfs83eFJ6comcJfujQweD2Ojy7d4oMMYDb85+Am132FgpT5V9rcuMenh bmAxwXq/7rXZNJzlni+TcPPpHXKgAkdCep+IKrul6r1Ugykj8mWKl2K/+VJaXt9vCZVZUd5G911lu kLbdFhNLWCkH8ye0WtibOstYi3blSkc3QGt4gCSf0uAe1OiTKMPqpz+uu8rGRpN8bMVmha5JlbE3F 2zEIbP5xjA2sztPeVOBN+YNn6yi7kmhJAgCpMISQ14G5os7ZIrPtNIs9o7BRIrgOuV6W62UuEw== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver002.ipa .domain.com@ipa.domain.com <mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com # HTTP/ipaserver001.ipa.domain.com@ipa.domain.com <mailto:ipaserver001.ipa.domain.com@ipa.domain.com> + f960b202-d14211e7-965fca1d -506f74cb, services, accounts, ipa.domain.com <http://ipa.domain.com> dn: krbprincipalname=HTTP/ipaserver001.ipa.domain.com@ipa.domain.com <mailto:ipaserver001.ipa.domain.com@ipa.domain.com>+nsunique id=f960b202-d14211e7-965fca1d-506f74cb,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: fe68c03a-d142-11e7-b3c2-0050569a7366 krbPrincipalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com <mailto:ipaserver001.ipa.domain.com@ipa.domain.com> managedBy: fqdn=ipaserver001.ipa.domain.com <http://ipaserver001.ipa.domain.com>,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com <mailto:ipaserver001.ipa.domain.com@ipa.domain.com> ipaKrbPrincipalAlias: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com <mailto:ipaserver001.ipa.domain.com@ipa.domain.com> objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE5jCCA86gAwIBAgIED/0ABTANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQK Ew1URU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTI0M TgxMjEyWhcNMTkxMTI1MTgxMjEyWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB 1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQo CggEBAOE+S90kJ+1zq0Ray0rOYZQn2Rve+Loi8Jy65UUR93CD8XrjHcptPOl3Nha7OM4vodABHgEH 2by8Qzza4FZkIvE+HbPqsHVATPcU9/WBsbXcCY5f1oD4vnu/Crzc9QYRJrMCoukELLVW7EntPVfZv 4/TXDIwE5BDiu4b623+JPjZ0sqHyUCKjcWiIexkp0c9TyeV3m1yYTzhA7TXxhCtgkhZCaPRnDFU8G NBy3upl1ethbPv65e4zwWAniulmIzpZ8jlMLbzeErTXbxAP2vaxpANJHRepd3hexCNRBpO+nOIHAj GSdiJhN/JpFS1g6ldTeI+rMxv0hqRQgUiC9CCxgkCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiW a54LyD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwY S1jYS50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQ UFBwMBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3M uaW8vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwV Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBQW9TaRJG4IdTlAkGGOleOAqYIL3TCBvQYDV R0RBIG1MIGygh1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMME hUVFAvcm8xLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgK gRTBDoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybzEtdG50LWlwYS0wMDEu dGVuYW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAeEtevJdlJK/EkMeE4lUFk5eMX/uhu8Ewr RZDpnpqMIp776QH64qiJTc4ZcA0ggrNePb1T92TLcOo4wW9N7Ih6/sgj7zhGS62EfzhRPsMoJayZh ZhPHkqFEI9UsVKMayBZTnvAB8pgkrmumh7S2rgp4alUSGSPhRMQ2GWEvI8554F2bF4q0wAl0S/qNX UdFtS76W2OATcZZyYL8ufQfYo6tcFyFTl6KiMPtP8jKi6v3pDjVCR1eHK0YKswBaHCsl9Wlzlnz9U Xbt9a/d0x+c1RO9sRkD4RbCQVaWgdlTyllsH66/J9QtG1AbFFidPt8JtxkOXjZ3J9oi/tiLoMUN5i A== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=http/ipaserver001.ipa .domain.com@ipa.domain.com <mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com # HTTP/ipaserver003.ipa.domain.com@ipa.domain.com <mailto:ipaserver003.ipa.domain.com@ipa.domain.com> + 5fffd19d-d21011e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com <http://ipa.domain.com> dn: krbprincipalname=HTTP/ipaserver003.ipa.domain.com@ipa.domain.com <mailto:ipaserver003.ipa.domain.com@ipa.domain.com>+nsunique id=5fffd19d-d21011e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 78d35f24-d210-11e7-b055-0050568cb5f0 krbPrincipalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com <mailto:ipaserver003.ipa.domain.com@ipa.domain.com> managedBy: fqdn=ipaserver003.ipa.domain.com <http://ipaserver003.ipa.domain.com>,cn=computers,cn=accounts,dc=tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com <mailto:ipaserver003.ipa.domain.com@ipa.domain.com> ipaKrbPrincipalAlias: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com <mailto:ipaserver003.ipa.domain.com@ipa.domain.com> objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBHjANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTI1MTg0M zA0WhcNMTkxMTI2MTg0MzA0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1ybz EtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE BANFhBMKFTE4xsmcld+NTEDgr5RyeHiQoVi695Lxh7LmT9ccBNPtZG6/4sceGQpcyJpdoZTFMxrFp 97ZgfZwtT09uJxGtTIHVFctGRACm5E4+NlW2MCSwsod9OXH4P8QTCMdAapmMWynKnFx+B3v7TJfES 7WRP7GkcHofFSVtN3X1bUpfk4Co+1mDV85q7QFTmPaMzcREWmCr+DCwG3cy+YZDIbsih07FkJeaTy lzIXvOEbQ7UaoZtMndH+8D/E4VboCV1x0Is0bjuCQqFcEiIQBgBHTPtXkMA5we+ZK4tsUgl1A0As7 Df1oFlISnj2JwrkX6Ox8y7acIPOgnD6ecxesCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSazpOqyaJc6zL8ZCqZLPIsmpT91jCBvQYDVR0RB IG1MIGygh1ybzEtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF Avcm8xLXRudC1pcGEtMDAzLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybzEtdG50LWlwYS0wMDMudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAVlKBrfmIUBVU129Dd96328+nBRAmQhEcs5//Y C4uF5AQ7a54f9kUWhaRj504E8gXX/Ffen2q3YxXRAl0KKhZDrOCYjjyJE7RfBTv4oNMG48PzoymvX RW/e7LWE1x2NtkyXt0MNKpEFFTWVYRq7Fz8KZqnasV48o6NW2js0ZRS3aR8F/SUqTT7hzSo8mTdFe 07L/MMtImQBFOB7qPZePZMABtkI4ot7sMMB9/tTgvX5bRkKrukGGa08qPBU9mM72V8BURnwKLzWcL 3EHcomjPmZ4Q83XhxeWBDhxC4dtLQ3LvQJEpxPAU/TFiBMxCEChnpWT+EG7tflVKft4nbdYFq3w== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver003.ipa .domain.com@ipa.domain.com <mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com # search result search: 2 result: 0 Success # numResponses: 6 # numEntries: 5 I uninstalled "oldipaserver" but I still get the replication conflict. I try to use ldapdelete but it keep on complaining about the syntax. Any suggestions? Thanks, Alex On Sat, Nov 25, 2017 at 11:57 AM, Sumit Bose via FreeIPA-users <freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>> wrote: On Fri, Nov 24, 2017 at 07:04:10PM -0500, Alexandre Pitre via FreeIPA-users wrote: > Hi, > > I had two freeipa replica servers up and running in our german DC for > nearly 2 months and this morning out of the blue they stopped working. > > Looking at ipactl status, both servers are reporting that their directory > service is stopped. Trying to restart ipa only works from 2 minutes to an > hour. > > Looking at the /var/log/dirsrv/slapd-DOMAIN-COM/errors there's no errors > that show up before it crash. > > However, looking at /var/log/messages, this lovely segfault show up: > > XXXXXX kernel: ns-slapd[17507]: segfault at 8 ip 00007fb99e56149f sp > 00007fb96bee83c0 error 4 in libslapd.s > o.0.1.0[7fb99e483000+128000] > > Out of despair to get production back up and running quickly, I reinstalled > one replica...it worked for an hour and came back with the same issue. > > We have 6 other freeipa replica running accross 3 different site with zero > issues. > > We're running CentOS 7.4 with the latest packages, ipa-server-4.5.0-21 & > 389-ds-base-1.3.6.1-21. > > Any clues why ? sorry, no clue but on http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes <http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes> you can see how to get a core dump file. Inspecting this might help to understand what is going wrong. bye, Sumit > > Thanks > > -- > Alexandre Pitre > alexandre.pitre@gmail.com <mailto:alexandre.pitre@gmail.com> > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> -- Alexandre Pitre alexandre.pitre@gmail.com <mailto:alexandre.pitre@gmail.com>-- Alexandre Pitre alexandre.pitre@gmail.com mailto:alexandre.pitre@gmail.com
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Hi Ludwig,
Thanks for your reply. We decided earlier today to restore from backup, that wasn't without issues but we had to get production back up running asap. I believe I fixed all the issues post backup restore and we seem to be in good shape now.
We're looking at migrating to redhat idm in the future as we can't afford facing such critical issues like that.
Thanks to Alexander Bokovoy on IRC as well for providing backup restore instructions.
Regards, Alex
On Wed, Nov 29, 2017 at 4:18 AM, Ludwig Krispenz via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
The crash looks very much like the one found in https://pagure.io/389-ds-base/issue/48894 it is fixed and the code has also been generally improved with: https://pagure.io/389-ds-base/issue/49401
As far as I can see these patches are not in 1.3.6.1-21, they are in upstream 1.3.6.10.
If you cannot get a version containing these patches, you could try to cleanup the entry state information by export/import reinitialize. It would mean on on server export the data to ldif without replication meta data and reimport it. But this changes the data generation and other replicas have to be reinitialized for replication to work again
Ludwig
On 11/28/2017 04:37 AM, Alexandre Pitre via FreeIPA-users wrote:
I managed to remove the replication conflicts but the orignal issue persist. I found a couple of triggers that crash the directory service, regardless of the freeipa server location. Here are the triggers:
- Deleting a host that exist in freeipa but no longer exist in our
infrastructure
- Deleting the same host from an hostgroup
- Re-building the auto membership of the hosts
What worry me the most is that I can't even delete the "dead hosts" from the ldap backend cn=computers OU...it crash the directory service as well.
Attached you'll find the stack trace generated from a core dump.
Please help.
Thanks
On Sun, Nov 26, 2017 at 11:06 PM, Alexandre Pitre < alexandre.pitre@gmail.com> wrote:
I believe I found the root cause.There are replication conflicts.
ldapsearch -x -D "cn=directory manager" -w password -b "dc=ipa,dc=domain,dc=com" "nsds5ReplConflict=*" * nsds5ReplConflict
# extended LDIF # # LDAPv3 # base <dc=ipa,dc=domain,dc=com> with scope subtree # filter: nsds5ReplConflict=* # requesting: * nsds5ReplConflict #
# oldipaserver + b4066f9e-cf0b11e7-9ad4d14c-07041c4f, ipa.domain.com., dns, t enant.domain.com dn: idnsName=oldipaserver+nsuniqueid=b4066f9e-cf0b11e7-9ad4d14c- 07041c4f,id nsname=ipa.domain.com.,cn=dns,dc=ipa,dc=domain,dc=com idnsName: oldipaserver objectClass: idnsRecord objectClass: top aRecord: 10.28.247.230 sSHFPRecord: 1 1 D179038D4D2918411C32C2E6052CBB561050EA48 sSHFPRecord: 1 2 78E7197543306DDA840AFF07296F66CBDA5BCC35A06E7A2E5229FC43 F28A E7EF sSHFPRecord: 3 1 8C9BF123F46F8F65507059F1CE670589B8A7B84A sSHFPRecord: 3 2 B60CE25FE4DB91975EB9055CADE6FF203F1154C6406B5DA6177659DF B88F 0E46 sSHFPRecord: 4 1 2FF7427DE66D360644E2901930F9CA105D47C33F sSHFPRecord: 4 2 98C424319EFF9D8EC8DFD12BB13286FC99F6006873D86739E2AA4A55 4C46 0E04 dNSTTL: 1200 nsds5ReplConflict: namingConflict idnsName=oldipaserver,idnsname =ipa.domain .com.,cn=dns,dc=ipa,dc=domain,dc=com
# HTTP/oldipaserver.ipa.domain.com@ipa.domain.com + aa37478f-cfb111e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/oldipaserver.ipa.domain.com@ipa.domain.com +nsunique id=aa37478f-cfb111e7-9ad4d14c-07041c4f,cn=services,cn= accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: c0db959a-cfb1-11e7-8ca5-0050568cb5f0 krbPrincipalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com managedBy: fqdn=oldipaserver.ipa.domain.com,cn=computers,cn=accounts,dc =tena nt,dc=domain,dc=com krbCanonicalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBFzANBgkqhk iG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHk wHhcNMTcxMTIyMTgyM DAxWhcNMTkxMTIzMTgyMDAxWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklP MSYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBB QADggEPADCCAQoCggE BAO9EpY9mT/Z4aA4wWse7rak2/Mh0qcAJHK3u5+SEq5eu70b7XAz/ivSOfn 4Q/DJW0jJS03GxLCIC NUAMzNINnkhuboKceNL1QDz41Bo19tyujhEQlJcdQVa6K0OM7YuKtsXfhI8 g8wrcj53YVJailfoSS iDmvvg/xNJ9P/6WvmvSNZyf7UkXdEM/lAkjEakqM1FPQN1lk/PB10pV6lZz zXSpBCbAU1GuV+srj6 zimvOS/WAgv2cG+iE0mDlfBnW+kqTd/qe5vW914oI4i1x5aLncMkNHsCDzN OBL05UV+Ry/3Un4pdi ZQCZU1BCKSy7hwhu0SgsI5hk5IPte6/aVG8ECAwEAAaOCAe4wggHqMB8GA1 UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYY jaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1Ud JQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhL nRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYT EeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBTsjF87tMtQQRowrXaotHV 5vErhxjCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEE AYI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT 6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG 50LWlwYS0wMDEudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAmclabyeU4abixWIv6f6 gCRgmXdwBzkvAjTxXP jfE6ZMwQUFYaoD71j3AxrPJMHnqtYDvPKkr5vkp0qn8ErxjWEBkFH57q0a8 z8bwp9enKL4wTALKrc NoGr0jCLdzR3RWK3+71ITXmWxb1AUsHFq5nuxktKaJC/5QKNQu2REZSscFl bBvI8gema9cjUm0eQ0 iwmSRSPagBWpYowj5eYV6oZBxRR4gtY3QoUKzWelAqPdkqvbF0u96uKfxET /crEqGGwJdA7xqLm8g S655zkM9b/++exlEFCp2cIxbP51Pinli+FRAQv9Bd75DxrXO6FzAU7UfjCh zTSfk3LRwpWG8aA== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/oldipaserver.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa, dc=domain,dc=com
# HTTP/ipaserver002.ipa.domain.com@ipa.domain.com + 691465b4-d08d11e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver002.ipa.domain.com@ipa.domain.com +nsunique id=691465b4-d08d11e7-9ad4d14c-07041c4f,cn=services,cn= accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 8d595d9c-d08d-11e7-9954-0050568cb5f0 krbPrincipalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver002.ipa.domain.com,cn=computers,cn=accounts,dc =tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBGjANBgkqhk iG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHk wHhcNMTcxMTIzMjAzM zI0WhcNMTkxMTI0MjAzMzI0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklP MSYwJAYDVQQDDB1tbz ItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBB QADggEPADCCAQoCggE BALsH9D9LIvvzYThtahRAT3E8QvkZLe/SbMU0P52vC4BVoTCCOYDLo6jCTB d925u0zId20hJx71nC 9wchvP3BLA0JexS8bh7U64u5CSTfLK9EPgsHqJgVve0Jz35KFhgcnOP8GqX vdtu1efMJL0hR4/U50 lftEZdy5cm/TSrJL/DncZ1Srl7hHgYIjRIQ5R8S/Axw5zE3eGd8+WsAVB5g qq4fOLUUsQp88ImUES oYtHHJ1O9s5N/Hz9AAy+TdcKRDj+EEIxoQNUsOms8H7dG6/wFRTb6mq2NBG T9sf2xBW+iUqoKGe0E kd273xqUGbUyJKuhrGRgHnyrai9G27YqulSsCAwEAAaOCAe4wggHqMB8GA1 UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYY jaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1Ud JQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhL nRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYT EeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSsrJU7LDvxTAIbOe1JFI7 r6PAcbzCBvQYDVR0RB IG1MIGygh1tbzItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pb6BABgorBgEE AYI3FAIDoDIMMEhUVF AvbW8yLXRudC1pcGEtMDAyLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT 6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG 50LWlwYS0wMDIudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAYcv6z2MlwgDOrcF9HHT pQ1e1Xo+aR1kUfyF53 mWTG5FYJ3BJZz00NhzRr16xfs83eFJ6comcJfujQweD2Ojy7d4oMMYDb85+ Am132FgpT5V9rcuMenh bmAxwXq/7rXZNJzlni+TcPPpHXKgAkdCep+IKrul6r1Ugykj8mWKl2K/+VJ aXt9vCZVZUd5G911lu kLbdFhNLWCkH8ye0WtibOstYi3blSkc3QGt4gCSf0uAe1OiTKMPqpz+uu8r GRpN8bMVmha5JlbE3F 2zEIbP5xjA2sztPeVOBN+YNn6yi7kmhJAgCpMISQ14G5os7ZIrPtNIs9o7B RIrgOuV6W62UuEw== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver002.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa, dc=domain,dc=com
# HTTP/ipaserver001.ipa.domain.com@ipa.domain.com + f960b202-d14211e7-965fca1d -506f74cb, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver001.ipa.domain.com@ipa.domain.com +nsunique id=f960b202-d14211e7-965fca1d-506f74cb,cn=services,cn= accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: fe68c03a-d142-11e7-b3c2-0050569a7366 krbPrincipalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver001.ipa.domain.com,cn=computers,cn=accounts,dc =tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE5jCCA86gAwIBAgIED/0ABTANBg kqhkiG9w0BAQsFADA4MRYwFAYDVQQK Ew1URU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3J pdHkwHhcNMTcxMTI0M TgxMjEyWhcNMTkxMTI1MTgxMjEyWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNT LklPMSYwJAYDVQQDDB 1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNA QEBBQADggEPADCCAQo CggEBAOE+S90kJ+1zq0Ray0rOYZQn2Rve+Loi8Jy65UUR93CD8XrjHcptPO l3Nha7OM4vodABHgEH 2by8Qzza4FZkIvE+HbPqsHVATPcU9/WBsbXcCY5f1oD4vnu/Crzc9QYRJrM CoukELLVW7EntPVfZv 4/TXDIwE5BDiu4b623+JPjZ0sqHyUCKjcWiIexkp0c9TyeV3m1yYTzhA7TX xhCtgkhZCaPRnDFU8G NBy3upl1ethbPv65e4zwWAniulmIzpZ8jlMLbzeErTXbxAP2vaxpANJHRep d3hexCNRBpO+nOIHAj GSdiJhN/JpFS1g6ldTeI+rMxv0hqRQgUiC9CCxgkCAwEAAaOCAe4wggHqMB 8GA1UdIwQYMBaAFNiW a54LyD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQc wAYYjaHR0cDovL2lwY S1jYS50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0G A1UdJQQWMBQGCCsGAQ UFBwMBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhL WNhLnRlbmFudC55Y3M uaW8vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcG FjYTEeMBwGA1UEAwwV Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBQW9TaRJG4IdTlAkGG OleOAqYIL3TCBvQYDV R0RBIG1MIGygh1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgor BgEEAYI3FAIDoDIMME hUVFAvcm8xLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDU y5JT6BPBgYrBgEFAgK gRTBDoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybz EtdG50LWlwYS0wMDEu dGVuYW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAeEtevJdlJK/EkMe E4lUFk5eMX/uhu8Ewr RZDpnpqMIp776QH64qiJTc4ZcA0ggrNePb1T92TLcOo4wW9N7Ih6/sgj7zh GS62EfzhRPsMoJayZh ZhPHkqFEI9UsVKMayBZTnvAB8pgkrmumh7S2rgp4alUSGSPhRMQ2GWEvI85 54F2bF4q0wAl0S/qNX UdFtS76W2OATcZZyYL8ufQfYo6tcFyFTl6KiMPtP8jKi6v3pDjVCR1eHK0Y KswBaHCsl9Wlzlnz9U Xbt9a/d0x+c1RO9sRkD4RbCQVaWgdlTyllsH66/J9QtG1AbFFidPt8JtxkO XjZ3J9oi/tiLoMUN5i A== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=http/ipaserver001.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa, dc=domain,dc=com
# HTTP/ipaserver003.ipa.domain.com@ipa.domain.com + 5fffd19d-d21011e7-9ad4d14c -07041c4f, services, accounts, ipa.domain.com dn: krbprincipalname=HTTP/ipaserver003.ipa.domain.com@ipa.domain.com +nsunique id=5fffd19d-d21011e7-9ad4d14c-07041c4f,cn=services,cn= accounts,dc=ipa,dc=y cs,dc=com ipaUniqueID: 78d35f24-d210-11e7-b055-0050568cb5f0 krbPrincipalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com managedBy: fqdn=ipaserver003.ipa.domain.com,cn=computers,cn=accounts,dc =tena nt,dc=domain,dc=com krbCanonicalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com ipaKrbPrincipalAlias: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com objectClass: krbprincipal objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipaservice objectClass: pkiuser objectClass: ipakrbprincipal objectClass: top userCertificate:: MIIE4zCCA8ugAwIBAgIBHjANBgkqhk iG9w0BAQsFADA4MRYwFAYDVQQKEw1U RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHk wHhcNMTcxMTI1MTg0M zA0WhcNMTkxMTI2MTg0MzA0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklP MSYwJAYDVQQDDB1ybz EtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBB QADggEPADCCAQoCggE BANFhBMKFTE4xsmcld+NTEDgr5RyeHiQoVi695Lxh7LmT9ccBNPtZG6/ 4sceGQpcyJpdoZTFMxrFp 97ZgfZwtT09uJxGtTIHVFctGRACm5E4+NlW2MCSwsod9OXH4P8QTCMdAapm MWynKnFx+B3v7TJfES 7WRP7GkcHofFSVtN3X1bUpfk4Co+1mDV85q7QFTmPaMzcREWmCr+DCwG3cy +YZDIbsih07FkJeaTy lzIXvOEbQ7UaoZtMndH+8D/E4VboCV1x0Is0bjuCQqFcEiIQBgBHTPtXkMA 5we+ZK4tsUgl1A0As7 Df1oFlISnj2JwrkX6Ox8y7acIPOgnD6ecxesCAwEAAaOCAe4wggHqMB8GA1 UdIwQYMBaAFNiWa54L yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYY jaHR0cDovL2lwYS1jY S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1Ud JQQWMBQGCCsGAQUFBw MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhL nRlbmFudC55Y3MuaW8 vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYT EeMBwGA1UEAwwVQ2Vy dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSazpOqyaJc6zL8ZCqZLPI smpT91jCBvQYDVR0RB IG1MIGygh1ybzEtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pb6BABgorBgEE AYI3FAIDoDIMMEhUVF Avcm8xLXRudC1pcGEtMDAzLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT 6BPBgYrBgEFAgKgRTB DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybzEtdG 50LWlwYS0wMDMudGVu YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAVlKBrfmIUBVU129Dd96 328+nBRAmQhEcs5//Y C4uF5AQ7a54f9kUWhaRj504E8gXX/Ffen2q3YxXRAl0KKhZDrOCYjjyJE7R fBTv4oNMG48PzoymvX RW/e7LWE1x2NtkyXt0MNKpEFFTWVYRq7Fz8KZqnasV48o6NW2js0ZRS3aR8 F/SUqTT7hzSo8mTdFe 07L/MMtImQBFOB7qPZePZMABtkI4ot7sMMB9/tTgvX5bRkKrukGGa08qPBU 9mM72V8BURnwKLzWcL 3EHcomjPmZ4Q83XhxeWBDhxC4dtLQ3LvQJEpxPAU/TFiBMxCEChnpWT+EG7 tflVKft4nbdYFq3w== krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou nts,dc=ipa,dc=domain,dc=com nsds5ReplConflict: namingConflict krbprincipalname=HTTP/ipaserver003.ipa .domain.com@ipa.domain.com,cn=services,cn=accounts,dc=ipa, dc=domain,dc=com
# search result search: 2 result: 0 Success
# numResponses: 6 # numEntries: 5
I uninstalled "oldipaserver" but I still get the replication conflict.
I try to use ldapdelete but it keep on complaining about the syntax.
Any suggestions?
Thanks, Alex
On Sat, Nov 25, 2017 at 11:57 AM, Sumit Bose via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
On Fri, Nov 24, 2017 at 07:04:10PM -0500, Alexandre Pitre via FreeIPA-users wrote:
Hi,
I had two freeipa replica servers up and running in our german DC for nearly 2 months and this morning out of the blue they stopped working.
Looking at ipactl status, both servers are reporting that their
directory
service is stopped. Trying to restart ipa only works from 2 minutes to
an
hour.
Looking at the /var/log/dirsrv/slapd-DOMAIN-COM/errors there's no
errors
that show up before it crash.
However, looking at /var/log/messages, this lovely segfault show up:
XXXXXX kernel: ns-slapd[17507]: segfault at 8 ip 00007fb99e56149f sp 00007fb96bee83c0 error 4 in libslapd.s o.0.1.0[7fb99e483000+128000]
Out of despair to get production back up and running quickly, I
reinstalled
one replica...it worked for an hour and came back with the same issue.
We have 6 other freeipa replica running accross 3 different site with
zero
issues.
We're running CentOS 7.4 with the latest packages, ipa-server-4.5.0-21
&
389-ds-base-1.3.6.1-21.
Any clues why ?
sorry, no clue but on http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes you can see how to get a core dump file. Inspecting this might help to understand what is going wrong.
bye, Sumit
Thanks
-- Alexandre Pitre alexandre.pitre@gmail.com
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedo
rahosted.org _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedo rahosted.org
-- Alexandre Pitre alexandre.pitre@gmail.com
-- Alexandre Pitre alexandre.pitre@gmail.com
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
-- Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Michael Cunningham, Michael O'Neill, Eric Shander
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
freeipa-users@lists.fedorahosted.org
-
Alexandre Pitre -
Ludwig Krispenz -
Sumit Bose