Prashanth Sundaram wrote:
I have two 389-ds servers with MMR via TLS and client hosts authenticating via TLS. I see this error message in all client machines in /var/log/messages. It seems nscd is failing at random intervals. Has anyone seen this before?
Dec 29 10:35:35 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable Dec 29 11:00:21 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable Dec 29 11:12:15 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable
Sure. It can be caused by several things: intermittent connectivity issues, server malfunctions (the server log's a good place to look for those), and several other possibilities.
It could also be caused by problems with nss_ldap itself, especially given the ldap.conf you've provided. What version are you running, and on which platform?
Thanks Pat
Both clients and ldap servers are running on Centos x86_64 5.4 nss_ldap-253-22.el5_4 nscd-2.5-42.el5_4.2
/etc/ldap.conf bind_policy soft timelimit 120 bind_timelimit 120 idle_timelimit 3600 pam_filter objectclass=posixAccount base dc=fds,dc=com pam_member_attribute uniquemember uri ldap://ldap.fds.com:389/ tls_checkpeer yes ssl start_tls tls_cacertdir /etc/pki/tls/certs/ pam_password md5 tls_cacertfile /etc/pki/tls/certs/ca-bundle.crt
Server logs do not say much other than errors/audit/access. It looks like bind_policy soft results in " Server is Unavailable" message. By changing to bind_policy hard, I get " nscd: nss_ldap: reconnected to LDAP server ldap://ldap.fds.com/ after 1 attempt". So that means ldap connection times-out at random intervals >1800 seconds. I found that there is a bug in
What is appropriate timelimit for search/bind/idle? To give some idea, we roughly have ~300 users and 600 servers.
Is there a timeout settings in 389-ds?
A bug in previous version of nscd: https://bugzilla.redhat.com/show_bug.cgi?id=429702
-P
On 12/30/09 6:00 PM, "patrick.morris@hp.com" patrick.morris@hp.com wrote:
Prashanth Sundaram wrote:
I have two 389-ds servers with MMR via TLS and client hosts authenticating via TLS. I see this error message in all client machines in /var/log/messages. It seems nscd is failing at random intervals. Has anyone seen this before?
Dec 29 10:35:35 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable Dec 29 11:00:21 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable Dec 29 11:12:15 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable
Sure. It can be caused by several things: intermittent connectivity issues, server malfunctions (the server log's a good place to look for those), and several other possibilities.
It could also be caused by problems with nss_ldap itself, especially given the ldap.conf you've provided. What version are you running, and on which platform?
Patrick,
I am still unable to figure out what is the cause for the clients to time-out on LDAP connection. Is there nay performance tuning that I am unaware of?
What is appropriate timelimit for search/bind/idle? To give some idea, we roughly have ~300 users and 600 servers.
Is there a timeout settings in 389-ds?
Thanks, Prashanth
On 12/30/09 6:00 PM, "patrick.morris@hp.com" patrick.morris@hp.com wrote:
Prashanth Sundaram wrote:
I have two 389-ds servers with MMR via TLS and client hosts authenticating via TLS. I see this error message in all client machines in /var/log/messages. It seems nscd is failing at random intervals. Has anyone seen this before?
Dec 29 10:35:35 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable Dec 29 11:00:21 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable Dec 29 11:12:15 dmc189 nscd: nss_ldap: could not search LDAP server - Server is unavailable
Sure. It can be caused by several things: intermittent connectivity issues, server malfunctions (the server log's a good place to look for those), and several other possibilities.
It could also be caused by problems with nss_ldap itself, especially given the ldap.conf you've provided. What version are you running, and on which platform?
389-users@lists.fedoraproject.org
-
Morris, Patrick -
Prashanth Sundaram