On Wed, Sep 16, 2020 at 05:26:14AM -0000, Boris Sukhinin via FreeIPA-users wrote:
It seems the problem is with a single replica only. Is was assigned request id range 19990001-20000000. Requests 19990001-19990008 were submitted some time ago, and requests 19990001-19990005 were overwritten in my recent attempts to install another replica. Note that CA doesn't always overwrite the first request, it actually increments request number, but still reusing already assigned ids.
Trying to install a replica one or two more times will solve the problem as CA will naturally start using previously unused request ids (I'm planning to restore overwritten requests from backup after that). But I don't like this solution because it doesn't tell us what exactly happened, why did it happen and how to avoid it in the future.
That being said, is there a way to verify the problem is actually with VLV indices without submitting new requests? Running ldapsearch -LLL -x -b "ou=ca,ou=requests,o=ipaca" -D "cn=Directory Manager" -W "(requeststate=*)" on every replica shows all the requests 19990001-19990008. Maybe you could point me to the exact mechanism / query / source code snippet used to select the next request id?
Regards, Boris
Hi Boris,
Yes, performing a VLV search is a bit fiddly but you can do it like this:
$ ldapsearch -LLL -D "cn=Directory Manager" -w $PASS -s one \ -b ou=ca,ou=requests,o=ipaca '(requeststate=*)' \ -E sss=requestId -E vlv=1/0:0820000000 requestId
This should show what, according to the VLV index, is the highest number in the range that has been used so far. The next number to be used will be one greater than that. (Note that there may be an entry greater than 20000000 in the result - it can be ignored).
I would be interested to see the exact command output if you are willing to share it. Maybe I didn't get the command or the VLV inputs exactly correct...
Cheers, Fraser