Problem updating IPA

[Sava Savchev]

I am running two IPA servers in replication on Oraclelinux8 with version ipa-server-4.9.13-10.0.1 and 389-ds version 1.4.3.39-8

When I try to update IPA to ipa-server-4.9.13-12.0.2 it fails on ipa-server-upgrade due to dirsrv not starting:
ipa-server-upgrade
Upgrading IPA:. Estimated time: 1 minute 30 seconds
  [1/9]: saving configuration
  [2/9]: disabling listeners
  [3/9]: enabling DS global lock
  [4/9]: disabling Schema Compat
  [5/9]: starting directory server
  [error] CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n')
  [cleanup]: stopping directory server
  [cleanup]: restoring configuration
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n')
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information

In dirsrv logs there is:
ERR - NSMMReplicationPlugin - changelog program - changelog5_init: failed to start changelog at /var/lib/dirsrv/slapd/cldb

When I revert back to the original version, everything is back to normal.

I have another cluster with the same configuration and I successfully updated. The only difference is that on the failing one I have enabled changelog encryption.

I don't know if this is the correct list to report this problem, but since it is emerging when I update IPA, I guess this is the right one :)

[Rob Crittenden]

Sava Savchev via FreeIPA-users wrote:
> I am running two IPA servers in replication on Oraclelinux8 with version ipa-server-4.9.13-10.0.1 and 389-ds version 1.4.3.39-8
>
> When I try to update IPA to ipa-server-4.9.13-12.0.2 it fails on ipa-server-upgrade due to dirsrv not starting:
> ipa-server-upgrade
> Upgrading IPA:. Estimated time: 1 minute 30 seconds
>   [1/9]: saving configuration
>   [2/9]: disabling listeners
>   [3/9]: enabling DS global lock
>   [4/9]: disabling Schema Compat
>   [5/9]: starting directory server
>   [error] CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n')
>   [cleanup]: stopping directory server
>   [cleanup]: restoring configuration
> IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
> Unexpected error - see /var/log/ipaupgrade.log for details:
> CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n')
> The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
>
> In dirsrv logs there is:
> ERR - NSMMReplicationPlugin - changelog program - changelog5_init: failed to start changelog at /var/lib/dirsrv/slapd/cldb
>
> When I revert back to the original version, everything is back to normal.

Revert how? From what to what?
> I have another cluster with the same configuration and I successfully updated. The only difference is that on the failing one I have enabled changelog encryption.
>
> I don't know if this is the correct list to report this problem, but since it is emerging when I update IPA, I guess this is the right one :)

Since this is a 389-ds-specific error I'd suggest
https://lists.fedoraproject.org/archives/list/[e-mail]....

rob

[Sava Savchev]

Rob Crittenden wrote:
> > Revert how? From what to what?

Downgrade to the previous installed IPA version - 4.9.13-10.0.1
> > Since this is a 389-ds-specific error I'd suggest
>
> https://lists.fedoraproject.org/archives/list/[e-mail]....

I will open a thread there. Thanks