How to investigate error "Cannot contact any KDC for realm" when it occured randomly ?

[lune voo]

Hello everyone.

I send you this mail because I have sometimes errors "Cannot contact any
KDC for realm". When I retry it works fine. So this error is kind of random.

I'm using Freeipa 3.0 in RHEL6.6 with sssd.

I was wondering how to investigate this kind of error ?

May I monitore some KPI from the KDC or check from logs ? Do you know which
kind of logs I can check ?

Thank you in advance for your help.

Best regards.

Lune

[Robbie Harwood]

lune voo via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
writes:

>  I'm using Freeipa 3.0 in RHEL6.6 with sssd. 
This version is pretty old, so I'm not sure how much support you're
going to get, but some thoughts:

>  I send you this mail because I have sometimes errors "Cannot
> contact
>  any KDC for realm". When I retry it works fine. So this error is kind
>  of random. 
How is your realm set up?  Are there multiple freeipa servers?  Do you
rely on DNS for discovery?  Is there anything in KRB5_TRACE output?

Thanks,
--Robbie

[Rob Crittenden]

lune voo via FreeIPA-users wrote:
>  Hello everyone.
>  
>  I send you this mail because I have sometimes errors "Cannot contact any
>  KDC for realm". When I retry it works fine. So this error is kind of random.
>  
>  I'm using Freeipa 3.0 in RHEL6.6 with sssd.
>  
>  I was wondering how to investigate this kind of error ?
>  
>  May I monitore some KPI from the KDC or check from logs ? Do you know
>  which kind of logs I can check ? 
You probably need to watch the SSSD logs. My guess would be DNS issues.

rob

[lune voo]

Hello Rob.

Thank you for your answer.

We are beginning a study to migrate to RHEL7 so I have hope for a new IPA
version sooner or later :-).

The ipa master is on a VM and we dont have multi master yet.

Hm, I don't use by defaut this environment variable, maybe I should
temporarily use it. When this problem occures and I retry the command.

Lune


Le jeu. 26 juil. 2018 à 19:15, Rob Crittenden <rcritten(a)redhat.com&gt; a
écrit :

>  lune voo via FreeIPA-users wrote:
>  > Hello everyone.
>  >
>  > I send you this mail because I have sometimes errors "Cannot contact any
>  > KDC for realm". When I retry it works fine. So this error is kind of
>  random.
>  >
>  > I'm using Freeipa 3.0 in RHEL6.6 with sssd.
>  >
>  > I was wondering how to investigate this kind of error ?
>  >
>  > May I monitore some KPI from the KDC or check from logs ? Do you know
>  > which kind of logs I can check ?
>
>  You probably need to watch the SSSD logs. My guess would be DNS issues.
>
>  rob
>