389-users November 2014

389-users@lists.fedoraproject.org

24 participants
29 discussions

Replication agreement issues
by Ted Strother 09 Nov '14

09 Nov '14

I'm attempting to set up an agreement with the wizard for userRoot on a single master (the hope was that once this was working a second master would be established), and every time I get the following error: LDAP server is unwilling to perform The error logs are equally useful: NSMMReplicationPlugin - agmtlist_add_callback: Can't start agreement (nameofagreementappearshere) I have had no issues with any of the other agreements, and it isn't specific to just one slave. Has anyone else seen this happen? Any tips? Thanks! -- Ted Strother Systems Administrator Senior Information Technology Services University of Michigan-Dearborn 19000 Hubbard Drive, 238 FCN Dearborn, MI 48126

1 0

Having issues installing on fc20
by Cawley, Chris 09 Nov '14

09 Nov '14

There is a problem with the install and ipv6/setup-ds-admin.pl . It keeps trying to bind to ipv6, etc. The work around have not been successful. Any suggestions are appreciated . Thanks - Chris Christopher J Cawley Senior Systems Engineer cawley(a)wrlc.org 301 390 2049

1 0

Please take an action: 389 Directory Server 1.2.11.X Discontinued for EL6
by Noriko Hosoi 07 Nov '14

07 Nov '14

389 Directory Server 1.2.11.X Discontinued for EL6 The 389 Directory Server team announces the binary release of 389-ds-base version 1.2.11 for EL6 will be stopped via temporary COPR repository. We encourage you to switch it to the official version included in the Red Hat Enterprise Linux 6 distribution or its equivalent OS. How to switch to the official version Remove a yum repo file which points to the temporary COPR repository (e.g., nhosoi-389-ds-base-epel6-epel-6.repo) from /etc/yum.repos.d. If the current 389 Directory Server 1.2.11 has the greater build number than 15, for instance, 1.2.11.32, downgrade it once by “yum downgrade” as follows. |yum downgrade 389-ds-base 389-ds-base-libs| Then, upgrade to make sure you have the latest version. |yum upgrade 389-ds-base| After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. |setup-ds-admin.pl -u| See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. http://www.port389.org/docs/389ds/releases/end-1-2-11.html

2 1

Re: [389-users] 389-Directory/1.3.1.6 cannot setup replica
by Ivanov Andrey (M.) 06 Nov '14

06 Nov '14

Hello Noriko, ----- Mail original ----- De: "Noriko Hosoi" <nhosoi(a)redhat.com> À: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Envoyé: Mercredi 5 Novembre 2014 21:26:47 Objet: Re: [389-users] 389-Directory/1.3.1.6 cannot setup replica Hello Andrey, On 11/05/2014 11:53 AM, Ivanov Andrey (M.) wrote: <blockquote> Hi, i'm having the same problem. I'm in the process of migration from our 389DS v1.2.10.25/CentOS5 to 389DS on CentOS 7. Everything is working fine on standalone servers but the replication (especially online initialization). It stucks _each time_ during the online initialization with SSL/TLS (and sometimes without SSL/TLS). And exactly with the same error messages as you describe. The network problems in my case are excluded - i used both virtual machines on the same ESXi in the same network and/or physical servers, the results are the same. I've tried compiling all the branches latest available (tags 1.3.2.24, 1.3.1.22, 1.3.3.5). In all the cases the result was the same. The server pushing the updates just gets stuck at some random number of entries sent to consumer (we have ~30000 entries, it gets stuck at random somewhere from 1200 to 25000 entries, the entries stuck have nothing particular in size, it's completely random). When you tried the versions "(tags 1.3.2.24, 1.3.1.22, 1.3.3.5)", it does not report any extra errors in the error log? E.g., <blockquote> Incoming BER Element was @@@ bytes, max allowable is ### bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. </blockquote> </blockquote> No - as i said, it was clearly not a problem of nsslapd-maxbersize or nsslapd-maxsasliosize or nsslapd-sasl-max-buffer-size, i'v checked it. Anyway, as i said, the on-line initialization has more chances to go to the end (sometimes it goes to the end with the same set of data) if i disable SSL, increase the number of CPUs in VM and increase the nsslapd-db-checkpoint-interval, each time it's stuck in a different place, so it's not entry-related... <blockquote> <blockquote> </blockquote> Next time it happens, could it be possible to get the stacktraces from the hung server? <blockquote> http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-hangs </blockquote> </blockquote> Ok, i'll do that tomorrow (for 1.3.2.24 since i'm testing mainly this one). It happens each time during a full on-line initialization, so it won't be difficult difficult to reproduce :) It does not really hang, only the online initialization hangs in fact (with the logs similar to the original mail)... <blockquote> <blockquote> </blockquote> <blockquote> 1.2.10.24 compiled with compat-db-4.7 on CentOS 7 has the least of these problems (and the initial replication is 10 times faster - it takes 8 seconds instead of 80 for 1.3.x!). I've been using 1.2.10.24 on CentOS5 compiled with mozilla ldap labraries and 1.2.10.23 obn CentOS 7 compiled with opendlap librarires. The first one had no problems at all to push the initial replication, the second one had intermittent problems, but much less than v1.3.x I've noticed that this problem is getting worse (or simply appears) if : * the replica is be of type 3 (multi-master), with replication agreements in both directions * our schema has several additional attribuites, it may be also important </blockquote> We improved the schema replication at some time, which should be in 1.3.2.24 and 1.3.3.5. https://fedorahosted.org/389/ticket/47721 </blockquote> The schema ldif is small and it is deployed before the initial on-line init, it is not replicated, so i don't think it's a problem. <blockquote> <blockquote> * if the virtual machine has only one CPU. Adding a second CPU increases the number of transferred entries before the initialization gets stuck. So it may me some thread/transaction contention or deadlock. * if the replication agreement uses SSL(port 636) or TLS(port389). Using port 389 with LDAP protocol instead of TLS/SSL increases the number of transferred entries before the initialization gets stuck. Sometimes the initialization even ends successfully in this case. * decreasing nsslapd-db-checkpoint-interval (say, to 5 seconds) also gets the problem worse </blockquote> This indicates the issue is in the BDB? </blockquote> Don't know. My hypotheses are : * using plugin transactions compared to 1.2.10.x * bdb version? but even with compat-db-47 and 1.2.10 the problem still happens on CentOS7, though much less frequently. It never happens with 1.2.10 with rpm bdb on CentOS5. * change from mozilla ldap libraries to openldap libraries? seems to be some sort of thread or transaction contention that is reduced when i add CPUs/increase checkpoint interval. It really looks like the master server just does not send entries any more at some moment... SSL/TLS slows the things down so less entries are sent before everything gets stuck... I'll get back with more information (stacktraces) tomorrrow. Thanks! <blockquote> Thanks, --noriko <blockquote> When the on-line intialization is finished (if it finishes), there are no problems. I think it is related to the volume of data transferred, so small incremental updates do not generate any problem.... If necessary, i will make any debugs/tests - it is a critical element of our infrastructure, so i'd like this problem to be resolved... Regards, Andrey IVANOV ----- Mail original ----- <blockquote> De: "陳含林" <laneovcc(a)gmail.com> À: 389-users(a)lists.fedoraproject.org Envoyé: Mercredi 5 Novembre 2014 18:01:37 Objet: [389-users] 389-Directory/1.3.1.6 cannot setup replica hello all, I have setup a IDM/freeipa master using CentOS7 , and import about 5000 hosts. then i try to setup a IDM/freeipa replication server by using ipa-replica-install. It seems the total update on replication server hangs after about 1000+ entries imported. I try to trigger a total update by setting nsds5beginreplicarefresh, but the result was the same. Any one help me ? Thanks! idm1 is the master, idm2 is the replication server. master server logs: [06/Nov/2014:00:21:48 +0800] - 389-Directory/ 1.3.1.6 B2014.219.1825 starting up [06/Nov/2014:00:21:48 +0800] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=idc [06/Nov/2014:00:21:51 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=idc--no CoS Templates found, which should be added before the CoS Definition. [06/Nov/2014:00:21:51 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=idc--no CoS Templates found, which should be added before the CoS Definition. [06/Nov/2014:00:21:51 +0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [06/Nov/2014:00:21:51 +0800] - Listening on All Interfaces port 636 for LDAPS requests [06/Nov/2014:00:21:51 +0800] - Listening on /var/run/slapd-IDC.socket for LDAPI requests [06/Nov/2014:00:21:51 +0800] - Entry "uid=admin,ou=people,o=ipaca" -- attribute "krbExtraData" not allowed [06/Nov/2014:00:40:26 +0800] NSMMReplicationPlugin - agmt="cn=meToidm2.ra.cn.idc" (idm2:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [06/Nov/2014:00:40:26 +0800] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=meToidm2.ra.cn.idc" (idm2:389)". replication server logs: [06/Nov/2014:00:40:18 +0800] - 389-Directory/ 1.3.1.6 B2014.219.1825 starting up [06/Nov/2014:00:40:18 +0800] ipalockout_get_global_config - [file ipa_lockout.c, line 185]: Failed to get default realm (-1765328160) [06/Nov/2014:00:40:18 +0800] ipaenrollment_start - [file ipa_enrollment.c, line 393]: Failed to get default realm?! [06/Nov/2014:00:40:18 +0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [06/Nov/2014:00:40:18 +0800] - Listening on All Interfaces port 636 for LDAPS requests [06/Nov/2014:00:40:18 +0800] - Listening on /var/run/slapd-IDC.socket for LDAPI requests [06/Nov/2014:00:40:19 +0800] NSMMReplicationPlugin - agmt="cn=meToidm1.ra.cn.idc" (idm1:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [06/Nov/2014:00:40:20 +0800] NSMMReplicationPlugin - multimaster_be_state_change: replica dc=idc is going offline; disabling replication [06/Nov/2014:00:40:20 +0800] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [06/Nov/2014:00:40:40 +0800] - import userRoot: Processed 1581 entries -- average rate 79.0/sec, recent rate 79.0/sec, hit ratio 0% [06/Nov/2014:00:41:00 +0800] - import userRoot: Processed 1581 entries -- average rate 39.5/sec, recent rate 39.5/sec, hit ratio 0% [06/Nov/2014:00:41:20 +0800] - import userRoot: Processed 1581 entries -- average rate 26.4/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:41:41 +0800] - import userRoot: Processed 1581 entries -- average rate 19.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:42:01 +0800] - import userRoot: Processed 1581 entries -- average rate 15.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:42:21 +0800] - import userRoot: Processed 1581 entries -- average rate 13.2/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:42:41 +0800] - import userRoot: Processed 1581 entries -- average rate 11.3/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:43:01 +0800] - import userRoot: Processed 1581 entries -- average rate 9.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:43:21 +0800] - import userRoot: Processed 1581 entries -- average rate 8.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:43:41 +0800] - import userRoot: Processed 1581 entries -- average rate 7.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:44:01 +0800] - import userRoot: Processed 1581 entries -- average rate 7.2/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:44:21 +0800] - import userRoot: Processed 1581 entries -- average rate 6.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:44:41 +0800] - import userRoot: Processed 1581 entries -- average rate 6.1/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:45:01 +0800] - import userRoot: Processed 1581 entries -- average rate 5.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:45:21 +0800] - import userRoot: Processed 1581 entries -- average rate 5.3/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:45:21 +0800] - import userRoot: Decided to end this pass because the progress rate has dropped below the 50% threshold. [06/Nov/2014:00:45:21 +0800] - import userRoot: Ending pass number 1 ... [06/Nov/2014:00:45:22 +0800] - import userRoot: Foreman is done; waiting for workers to finish... [06/Nov/2014:00:45:22 +0800] - import userRoot: Workers finished; cleaning up... [06/Nov/2014:00:45:22 +0800] - import userRoot: Workers cleaned up. [06/Nov/2014:00:45:22 +0800] - import userRoot: Sweeping files for merging later... [06/Nov/2014:00:45:22 +0800] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [06/Nov/2014:00:45:22 +0800] - import userRoot: Sweep done. [06/Nov/2014:00:45:22 +0800] - import userRoot: Beginning pass number 2 [06/Nov/2014:00:45:42 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 214748285.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:46:02 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 107374142.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:46:22 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 71582761.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:46:42 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 53687071.4/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:47:02 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 42949657.1/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:47:22 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 35791381.0/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:47:43 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 30678326.5/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:48:03 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 26843535.7/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:48:23 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 23860920.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:48:43 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 21474828.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:49:03 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 19522571.4/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:49:23 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 17895690.5/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:49:43 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 16519098.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:50:03 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 15339163.3/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:50:23 +0800] - import userRoot: Processed 1722 entries (pass 2) -- average rate 0.5/sec, recent rate 43.0/sec, hit ratio 0% [06/Nov/2014:00:50:26 +0800] - import userRoot: Workers finished; cleaning up... [06/Nov/2014:00:50:26 +0800] - import userRoot: Workers cleaned up. [06/Nov/2014:00:50:26 +0800] - import userRoot: Sweeping files for merging later... [06/Nov/2014:00:50:26 +0800] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [06/Nov/2014:00:50:26 +0800] - import userRoot: Sweep done. [06/Nov/2014:00:50:26 +0800] - import userRoot: Beginning 2-way merge of up to 44 files... [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "aci". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "automountkey". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "carLicense". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "cn". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "displayname". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "entryusn". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "fqdn". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "gidnumber". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "givenName". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipakrbprincipalalias". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipasudorunas". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipasudorunasgroup". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipauniqueid". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "krbPrincipalName". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "macAddress". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "mail". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "mailAlternateAddress". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "mailHost". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "managedby". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "manager". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "member". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "memberallowcmd". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "memberdenycmd". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "memberHost". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "memberOf". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "memberservice". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "memberUser". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "nscpEntryDN". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "nsds5ReplConflict". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "nsuniqueid". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "ntUniqueId". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "ntUserDomainId". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "objectclass". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "ou". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "owner". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "secretary". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "seeAlso". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "sn". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "sourcehost". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "telephoneNumber". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "title". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "uid". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "uidnumber". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "uniquemember". [06/Nov/2014:00:50:27 +0800] - import userRoot: Merging completed in 0 seconds. [06/Nov/2014:00:50:27 +0800] - import userRoot: Indexing complete. Post-processing... [06/Nov/2014:00:50:27 +0800] - import userRoot: Generating numSubordinates complete. [06/Nov/2014:00:50:27 +0800] - import userRoot: Flushing caches... [06/Nov/2014:00:50:27 +0800] - import userRoot: Closing files... [06/Nov/2014:00:50:27 +0800] - import userRoot: Import complete. Processed 1722 entries in 607 seconds. (2.84 entries/sec) [06/Nov/2014:00:50:27 +0800] NSMMReplicationPlugin - multimaster_be_state_change: replica dc=idc is coming online; enabling replication [06/Nov/2014:00:50:27 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=idc--no CoS Templates found, which should be added before the CoS Definition. mapping tree # extended LDIF # # LDAPv3 # base <cn=mapping tree,cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # mapping tree, config dn: cn=mapping tree,cn=config objectClass: top objectClass: extensibleObject cn: mapping tree # dc\3Didc, mapping tree, config dn: cn=dc\3Didc,cn=mapping tree,cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree cn: dc=idc cn: "dc=idc" nsslapd-state: backend nsslapd-backend: userRoot nsslapd-referral: ldap://idm1.ra.cn.idc:389/dc%3Didc # replica, dc\3Didc, mapping tree, config dn: cn=replica,cn=dc\3Didc,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 objectClass: top objectClass: nsds5replica objectClass: extensibleobject nsDS5ReplicaType: 3 nsDS5ReplicaRoot: dc=idc nsds5ReplicaLegacyConsumer: off nsDS5ReplicaId: 3 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsState:: AwAAAAAAAADzUlpUAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAA== nsDS5ReplicaName: 6cf48589-650a11e4-90ecc46a-d11f6771 nsds5ReplicaChangeCount: 0 nsds5replicareapactive: 0 # meToidm1.ra.cn.idc, replica, dc\3Didc, mapping tree, config dn: cn=meToidm1.ra.cn.idc,cn=replica,cn=dc\3Didc,cn=mapping tree,cn=config cn: meToidm1.ra.cn.idc objectClass: nsds5replicationagreement objectClass: top nsDS5ReplicaTransportInfo: TLS description: me to idm1.ra.cn.idc nsDS5ReplicaRoot: dc=idc nsDS5ReplicaHost: idm1.ra.cn.idc nsds5replicaTimeout: 600 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaPort: 389 nsDS5ReplicaBindMethod: simple nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName in ternalModifyTimestamp nsDS5ReplicaCredentials: {DES} nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn krblasts uccessfulauth krblastfailedauth krbloginfailedcount nsds5replicareapactive: 0 nsds5replicaLastUpdateStart: 0 nsds5replicaLastUpdateEnd: 0 nsds5replicaChangesSentSinceStartup: nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized nsds5replicaUpdateInProgress: FALSE nsds5replicaLastInitStart: 0 nsds5replicaLastInitEnd: 0 # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4 -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users </blockquote> -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users </blockquote> -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users </blockquote>

3 5

389-Directory/1.3.1.6 cannot setup replica
by 陳含林 06 Nov '14

06 Nov '14

hello all, I have setup a IDM/freeipa master using CentOS7 , and import about 5000 hosts. then i try to setup a IDM/freeipa replication server by using ipa-replica-install. It seems the total update on replication server hangs after about 1000+ entries imported. I try to trigger a total update by setting nsds5beginreplicarefresh, but the result was the same. Any one help me ? Thanks! idm1 is the master, idm2 is the replication server. master server logs: [06/Nov/2014:00:21:48 +0800] - 389-Directory/1.3.1.6 B2014.219.1825 starting up [06/Nov/2014:00:21:48 +0800] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=idc [06/Nov/2014:00:21:51 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=idc--no CoS Templates found, which should be added before the CoS Definition. [06/Nov/2014:00:21:51 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=idc--no CoS Templates found, which should be added before the CoS Definition. [06/Nov/2014:00:21:51 +0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [06/Nov/2014:00:21:51 +0800] - Listening on All Interfaces port 636 for LDAPS requests [06/Nov/2014:00:21:51 +0800] - Listening on /var/run/slapd-IDC.socket for LDAPI requests [06/Nov/2014:00:21:51 +0800] - Entry "uid=admin,ou=people,o=ipaca" -- attribute "krbExtraData" not allowed [06/Nov/2014:00:40:26 +0800] NSMMReplicationPlugin - agmt="cn=meToidm2.ra.cn.idc" (idm2:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [06/Nov/2014:00:40:26 +0800] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=meToidm2.ra.cn.idc" (idm2:389)". replication server logs: [06/Nov/2014:00:40:18 +0800] - 389-Directory/1.3.1.6 B2014.219.1825 starting up [06/Nov/2014:00:40:18 +0800] ipalockout_get_global_config - [file ipa_lockout.c, line 185]: Failed to get default realm (-1765328160) [06/Nov/2014:00:40:18 +0800] ipaenrollment_start - [file ipa_enrollment.c, line 393]: Failed to get default realm?! [06/Nov/2014:00:40:18 +0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [06/Nov/2014:00:40:18 +0800] - Listening on All Interfaces port 636 for LDAPS requests [06/Nov/2014:00:40:18 +0800] - Listening on /var/run/slapd-IDC.socket for LDAPI requests [06/Nov/2014:00:40:19 +0800] NSMMReplicationPlugin - agmt="cn=meToidm1.ra.cn.idc" (idm1:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [06/Nov/2014:00:40:20 +0800] NSMMReplicationPlugin - multimaster_be_state_change: replica dc=idc is going offline; disabling replication [06/Nov/2014:00:40:20 +0800] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [06/Nov/2014:00:40:40 +0800] - import userRoot: Processed 1581 entries -- average rate 79.0/sec, recent rate 79.0/sec, hit ratio 0% [06/Nov/2014:00:41:00 +0800] - import userRoot: Processed 1581 entries -- average rate 39.5/sec, recent rate 39.5/sec, hit ratio 0% [06/Nov/2014:00:41:20 +0800] - import userRoot: Processed 1581 entries -- average rate 26.4/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:41:41 +0800] - import userRoot: Processed 1581 entries -- average rate 19.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:42:01 +0800] - import userRoot: Processed 1581 entries -- average rate 15.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:42:21 +0800] - import userRoot: Processed 1581 entries -- average rate 13.2/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:42:41 +0800] - import userRoot: Processed 1581 entries -- average rate 11.3/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:43:01 +0800] - import userRoot: Processed 1581 entries -- average rate 9.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:43:21 +0800] - import userRoot: Processed 1581 entries -- average rate 8.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:43:41 +0800] - import userRoot: Processed 1581 entries -- average rate 7.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:44:01 +0800] - import userRoot: Processed 1581 entries -- average rate 7.2/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:44:21 +0800] - import userRoot: Processed 1581 entries -- average rate 6.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:44:41 +0800] - import userRoot: Processed 1581 entries -- average rate 6.1/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:45:01 +0800] - import userRoot: Processed 1581 entries -- average rate 5.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:45:21 +0800] - import userRoot: Processed 1581 entries -- average rate 5.3/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:45:21 +0800] - import userRoot: Decided to end this pass because the progress rate has dropped below the 50% threshold. [06/Nov/2014:00:45:21 +0800] - import userRoot: Ending pass number 1 ... [06/Nov/2014:00:45:22 +0800] - import userRoot: Foreman is done; waiting for workers to finish... [06/Nov/2014:00:45:22 +0800] - import userRoot: Workers finished; cleaning up... [06/Nov/2014:00:45:22 +0800] - import userRoot: Workers cleaned up. [06/Nov/2014:00:45:22 +0800] - import userRoot: Sweeping files for merging later... [06/Nov/2014:00:45:22 +0800] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [06/Nov/2014:00:45:22 +0800] - import userRoot: Sweep done. [06/Nov/2014:00:45:22 +0800] - import userRoot: Beginning pass number 2 [06/Nov/2014:00:45:42 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 214748285.8/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:46:02 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 107374142.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:46:22 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 71582761.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:46:42 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 53687071.4/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:47:02 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 42949657.1/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:47:22 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 35791381.0/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:47:43 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 30678326.5/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:48:03 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 26843535.7/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:48:23 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 23860920.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:48:43 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 21474828.6/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:49:03 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 19522571.4/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:49:23 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 17895690.5/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:49:43 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 16519098.9/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:50:03 +0800] - import userRoot: Processed 1581 entries (pass 2) -- average rate 15339163.3/sec, recent rate 0.0/sec, hit ratio 0% [06/Nov/2014:00:50:23 +0800] - import userRoot: Processed 1722 entries (pass 2) -- average rate 0.5/sec, recent rate 43.0/sec, hit ratio 0% [06/Nov/2014:00:50:26 +0800] - import userRoot: Workers finished; cleaning up... [06/Nov/2014:00:50:26 +0800] - import userRoot: Workers cleaned up. [06/Nov/2014:00:50:26 +0800] - import userRoot: Sweeping files for merging later... [06/Nov/2014:00:50:26 +0800] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [06/Nov/2014:00:50:26 +0800] - import userRoot: Sweep done. [06/Nov/2014:00:50:26 +0800] - import userRoot: Beginning 2-way merge of up to 44 files... [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "aci". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "automountkey". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "carLicense". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "cn". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "displayname". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "entryusn". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "fqdn". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "gidnumber". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "givenName". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipakrbprincipalalias". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipasudorunas". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipasudorunasgroup". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "ipauniqueid". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "krbPrincipalName". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "macAddress". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "mail". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "mailAlternateAddress". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "mailHost". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "managedby". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "manager". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "member". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "memberallowcmd". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "memberdenycmd". [06/Nov/2014:00:50:26 +0800] - import userRoot: No files to merge for "memberHost". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "memberOf". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "memberservice". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "memberUser". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "nscpEntryDN". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "nsds5ReplConflict". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "nsuniqueid". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "ntUniqueId". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "ntUserDomainId". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "objectclass". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "ou". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "owner". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "secretary". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "seeAlso". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "sn". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "sourcehost". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "telephoneNumber". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "title". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "uid". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "uidnumber". [06/Nov/2014:00:50:27 +0800] - import userRoot: No files to merge for "uniquemember". [06/Nov/2014:00:50:27 +0800] - import userRoot: Merging completed in 0 seconds. [06/Nov/2014:00:50:27 +0800] - import userRoot: Indexing complete. Post-processing... [06/Nov/2014:00:50:27 +0800] - import userRoot: Generating numSubordinates complete. [06/Nov/2014:00:50:27 +0800] - import userRoot: Flushing caches... [06/Nov/2014:00:50:27 +0800] - import userRoot: Closing files... [06/Nov/2014:00:50:27 +0800] - import userRoot: Import complete. Processed 1722 entries in 607 seconds. (2.84 entries/sec) [06/Nov/2014:00:50:27 +0800] NSMMReplicationPlugin - multimaster_be_state_change: replica dc=idc is coming online; enabling replication [06/Nov/2014:00:50:27 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=idc--no CoS Templates found, which should be added before the CoS Definition. mapping tree # extended LDIF # # LDAPv3 # base <cn=mapping tree,cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # mapping tree, config dn: cn=mapping tree,cn=config objectClass: top objectClass: extensibleObject cn: mapping tree # dc\3Didc, mapping tree, config dn: cn=dc\3Didc,cn=mapping tree,cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree cn: dc=idc cn: "dc=idc" nsslapd-state: backend nsslapd-backend: userRoot nsslapd-referral: ldap://idm1.ra.cn.idc:389/dc%3Didc # replica, dc\3Didc, mapping tree, config dn: cn=replica,cn=dc\3Didc,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 objectClass: top objectClass: nsds5replica objectClass: extensibleobject nsDS5ReplicaType: 3 nsDS5ReplicaRoot: dc=idc nsds5ReplicaLegacyConsumer: off nsDS5ReplicaId: 3 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsState:: AwAAAAAAAADzUlpUAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAA== nsDS5ReplicaName: 6cf48589-650a11e4-90ecc46a-d11f6771 nsds5ReplicaChangeCount: 0 nsds5replicareapactive: 0 # meToidm1.ra.cn.idc, replica, dc\3Didc, mapping tree, config dn: cn=meToidm1.ra.cn.idc,cn=replica,cn=dc\3Didc,cn=mapping tree,cn=config cn: meToidm1.ra.cn.idc objectClass: nsds5replicationagreement objectClass: top nsDS5ReplicaTransportInfo: TLS description: me to idm1.ra.cn.idc nsDS5ReplicaRoot: dc=idc nsDS5ReplicaHost: idm1.ra.cn.idc nsds5replicaTimeout: 600 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaPort: 389 nsDS5ReplicaBindMethod: simple nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName in ternalModifyTimestamp nsDS5ReplicaCredentials: {DES} nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn krblasts uccessfulauth krblastfailedauth krbloginfailedcount nsds5replicareapactive: 0 nsds5replicaLastUpdateStart: 0 nsds5replicaLastUpdateEnd: 0 nsds5replicaChangesSentSinceStartup: nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized nsds5replicaUpdateInProgress: FALSE nsds5replicaLastInitStart: 0 nsds5replicaLastInitEnd: 0 # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4

3 4

389-admin console
by ghiureai 04 Nov '14

04 Nov '14

I'm having a issues when running 389-console from a local host will not display the correct ds/ local ds instead is pointing to another remote host ds, and I'm not able to see the local ds ? What has been messed up? Thank you Isabella

2 1

Re: [389-users] Dse.ldif file modification issues
by Ghiurea, Isabella 04 Nov '14

04 Nov '14

_____________________________________________ From: Ghiurea, Isabella Sent: November-03-14 12:55 PM To: 389-users-request(a)lists.fedoraproject.org Subject: Dse.ldif file modification issues Hi List, I restore a ds from on server to second host , an copy the dse.ldif file , trying to update the entry for nsslap-localhost on second server is still pointing to first one /initial ds , how can we update this entry , why is still can't take the host name in dse.ldif Thank you Isabella

2 1

Solaris 5.2 DS replicate to 389 DS
by Gary Algier 03 Nov '14

03 Nov '14

Hello, I am looking for help with creating a replication agreement between a Solaris DS and a 389 DS. I says in the FAQ: ------------------------------------------------------------------------ Sun DS 5.2 changed the replication protocol, so you cannot do Sun DS 5.2 style replication with 389. However, Sun DS 5.2 has a legacy replication mode with which they are able to replicate to their 5.1 and 5.0 servers. This replication mode works with 389. ------------------------------------------------------------------------ My Solaris DS is 5.2.4, my 389 DS is 389-ds-base-1.3.2.23-1.fc20. I have setup a legacy consumer on 389 DS and a replication agreement on Solaris DS. No matter what I do it does not seem to want to replicate. I even tried setting the Solaris 4.x replication mode (which does not help). I don't see anyplace to say I want 5.0/5.1-style replication. Is there anyone who has successfully made this replication work that might be willing to help? -- Gary Algier, WB2FWZ gaa(a)ulticom.com +1 856 787 2758 Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033

2 2

cannot modify db-home-directory at runtime
by Alan Willis 03 Nov '14

03 Nov '14

I'm trying to setup a server which uses /dev/shm as the db home dir in much the same way described in this ticket: https://fedorahosted.org/389/ticket/469 >From the description in the ticket, it appears that the entry can be modified at runtime. However when I attempt this, I get an error stating that this value cannot be modified at runtime. The only way I have gotten this to work is by modifying the dse.ldif directly and adding the attribute. Can this be made to require a reboot to take effect? -alan -- [image: fist]Alan Willis Systems Administrator | Riot Games Email: alwillis at riotgames.com For, to speak out once for all, man only plays when in the full meaning of the word he is a man, and *he is only completely a man when he plays*. - J.C. Friedrich von Schiller - Letters upon the Æsthetic Education of Man

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2014