For the last few months, shutdown/poweroff of freeipa server systems hangs until systemd forcibly terminates freeipa. During that time I see ns-slapd at nearly full CPU consumption. I see log entries such as:
ipa-dnskeysyncd[1578]: ipaserver.dnssec.syncrepl
even though there are no domains with dnssec active (though it is installed).
Upon restart, freeipa complains of 'unclean shutdown' or similar, every time.
Is anyone else seeing this? Is there an answer to this?
Thanks
Harry Coin
Harry G. Coin via FreeIPA-users wrote:
For the last few months, shutdown/poweroff of freeipa server systems hangs until systemd forcibly terminates freeipa. During that time I see ns-slapd at nearly full CPU consumption. I see log entries such as:
ipa-dnskeysyncd[1578]: ipaserver.dnssec.syncrepl
even though there are no domains with dnssec active (though it is installed).
Upon restart, freeipa complains of 'unclean shutdown' or similar, every time.
Is anyone else seeing this? Is there an answer to this?
Does this also happen if you run ipactl stop?
If so you could attach gdb to ns-slapd and get a stack trace for further investigation.
rob
On 1/7/22 09:17, Rob Crittenden wrote:
Harry G. Coin via FreeIPA-users wrote:
For the last few months, shutdown/poweroff of freeipa server systems hangs until systemd forcibly terminates freeipa. During that time I see ns-slapd at nearly full CPU consumption. I see log entries such as:
ipa-dnskeysyncd[1578]: ipaserver.dnssec.syncrepl
even though there are no domains with dnssec active (though it is installed).
Upon restart, freeipa complains of 'unclean shutdown' or similar, every time.
Is anyone else seeing this? Is there an answer to this?
Does this also happen if you run ipactl stop?
Well spotted! ipactl stop does it's work properly and in a timely way. But poweroff/restart is managed by systemd and the 'high cpu ns-slapd forever until killed by force' is 100% repeatable -- So maybe it's a systemd thing, killing off something dirsrv needs too early?
Thanks
HC
Harry G. Coin wrote:
On 1/7/22 09:17, Rob Crittenden wrote:
Harry G. Coin via FreeIPA-users wrote:
For the last few months, shutdown/poweroff of freeipa server systems hangs until systemd forcibly terminates freeipa. During that time I see ns-slapd at nearly full CPU consumption. I see log entries such as:
ipa-dnskeysyncd[1578]: ipaserver.dnssec.syncrepl
even though there are no domains with dnssec active (though it is installed).
Upon restart, freeipa complains of 'unclean shutdown' or similar, every time.
Is anyone else seeing this? Is there an answer to this?
Does this also happen if you run ipactl stop?
Well spotted! ipactl stop does it's work properly and in a timely way. But poweroff/restart is managed by systemd and the 'high cpu ns-slapd forever until killed by force' is 100% repeatable -- So maybe it's a systemd thing, killing off something dirsrv needs too early?
Interesting. Maybe? I think for the most part the ipa service masks the services it starts/stops to prevent this so that it can control the order of operations. I haven't had a chance to try to reproduce this yet. What release are you using?
systemd has a shutdown dependency lister but I wasn't able to make much sense out of the output.
Maybe some kludge to get a stack: sleep 30 && pstack `pidof ns-slapd` to see what it's doing?
rob
freeipa-users@lists.fedorahosted.org
-
Harry G. Coin -
Rob Crittenden