<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Exchange Server">  <style></style> </head> <body> <font face="Calibri" size="2"><span style="font-size:11pt;"> <div>I have linked a zip the whole directory from abrt. After typing "abrt-cli -l" it outputted:</div> <div>-----</div> <div>Directory: /var/spool/abrt/ccpp-2011-09-09-13:41:51-972</div> <div>count: 1</div> <div>executable: /usr/sbin/krb5kdc</div> <div>package: krb5-server-1.9.1-5.fc15</div> <div>time: Fri 09 Sep 2011 01:41:51 PM CDT</div> <div>uid: 0</div> <div>-----</div> <div> </div> <div>Link to <a href="http://studentweb.stcloudstate.edu/smma0901/crash.zip"><font color="blue"><u>crash.zip</u></font></a> </div> <div> </div> <div>This appears to be my current ldap "openldap-2.4.24-3.fc15.x86_64". </div> <div> </div> <div> </div> <div>-Martin</div> <div> </div> <div> </div> <div>-----Original Message-----</div> <div>From: Simo Sorce <a href="mailto:[mailto:simo@redhat.com]"><font color="blue"><u>[mailto:simo@redhat.com]</u></font></a> </div> <div>Sent: Friday, September 09, 2011 12:38 PM</div> <div>To: Smith, Martin R. [smma0901@stcloudstate.edu]</div> <div>Cc: <a href="mailto:freeipa-users@redhat.com"><font color="blue"><u>freeipa-users@redhat.com</u></font></a></div> <div>Subject: Re: [Freeipa-users] krb5kdc process at 100%</div> <div> </div> <div>If it crashes it is a bug in the KDC.</div> <div>Can you please get us the core dump when it crashes ?</div> <div> </div> <div>If you have abtrd installed it should be somewhere in /var/cache/abrt (check /var/log/messages) to see where.</div> <div> </div> <div>Alternatively you can run service krb5kdc stop then as root in a shell run ulimit -c unlimited and manually start /usr/sbin/krb5kdc wait for the crash then take the core file generated.</div> <div> </div> <div>Please also tell what is the exact version of the krb5-server package and the related ldap driver package.</div> <div> </div> <div>Simo.</div> <div> </div> <div>On Fri, 2011-09-09 at 16:27 +0000, Smith, Martin R.</div> <div>[smma0901@stcloudstate.edu] wrote:</div> <div>> I removed the -w 4 from the config file. Here is what happens now. </div> <div>> </div> <div>> When a user with expired password logs in the krb5kdc process now crashes, instead of running at 100%. </div> <div>> If I attach gdb to the process before it crashes and attempt to login the process doesn't crash. Here are the results of "bt"</div> <div>> ---------</div> <div>> #0 0x00007fe84e0ea1d3 in __select_nocancel ()</div> <div>> at ../sysdeps/unix/syscall-template.S:82</div> <div>> #1 0x00007fe84f2a8047 in krb5int_cm_call_select (in=<optimized out>,</div> <div>> out=0x7fe8501d8780, sret=0x7fff421862b4) at sendto_kdc.c:564</div> <div>> #2 0x00007fe84ffd05ee in listen_and_process (handle=0x0,</div> <div>> prog=0x7fff42187f52 "krb5kdc", reset=0x7fe84ffc6e10 <reset_for_hangup>)</div> <div>> at net-server.c:1835</div> <div>> #3 0x00007fe84ffbcf68 in main (argc=3, argv=<optimized out>) at </div> <div>> main.c:1069</div> <div>> --------</div> <div>> </div> <div>> I have also attached the /var/log/krb5kdc</div> <div>> </div> <div>> -Martin</div> <div>> </div> <div>> -----Original Message-----</div> <div>> From: Simo Sorce <a href="mailto:[mailto:simo@redhat.com]"><font color="blue"><u>[mailto:simo@redhat.com]</u></font></a></div> <div>> Sent: Friday, September 09, 2011 8:56 AM</div> <div>> To: Smith, Martin R. [smma0901@stcloudstate.edu]</div> <div>> Cc: <a href="mailto:freeipa-users@redhat.com"><font color="blue"><u>freeipa-users@redhat.com</u></font></a></div> <div>> Subject: Re: [Freeipa-users] krb5kdc process at 100%</div> <div>> </div> <div>> On Fri, 2011-09-09 at 05:09 +0000, Smith, Martin R.</div> <div>> [smma0901@stcloudstate.edu] wrote:</div> <div>> > When I attach gdb to the process, I have tried the main process and </div> <div>> > the four child processes, it provides no output.</div> <div>> > Here are the steps I'm taking:</div> <div>> > 1. On freeipa-server run htop and find the pid (or ps aux) </div> <div>> > 1. Shows one parent PID and four child processes </div> <div>> > 1. 934 root 20 0 46784 2656 388 S 0.0 0.1</div> <div>> > 0:00.00 `- /usr/sbin/krb5kdc</div> <div>> > -P /var/run/krb5kdc.pid -w 4</div> <div>> > 2. 1939 root 20 0 78664 4460 2056 S 0.0</div> <div>> > 0.1 0:00.26 | `- /usr/sbin/krb5kdc</div> <div>> > -P /var/run/krb5kdc.pid -w 4</div> <div>> > 3. 1938 root 20 0 78664 4460 2056 S 0.0</div> <div>> > 0.1 0:00.26 | `- /usr/sbin/krb5kdc</div> <div>> > -P /var/run/krb5kdc.pid -w 4</div> <div>> > 4. 1936 root 20 0 78664 4460 2056 S 0.0</div> <div>> > 0.1 0:00.26 | `- /usr/sbin/krb5kdc</div> <div>> > -P /var/run/krb5kdc.pid -w 4</div> <div>> > 5. 1935 root 20 0 78664 4212 1808 S 0.0</div> <div>> > 0.1 0:00.26 | `- /usr/sbin/krb5kdc</div> <div>> > -P /var/run/krb5kdc.pid -w 4</div> <div>> > 2. run sudo gdb </div> <div>> > 1. attach 934</div> <div>> > 2. press "c"</div> <div>> > 3. Wait for output… </div> <div>> > 2. Attempt to login with user that has an expired password.</div> <div>> > 3. Now the krb5kdc process 934 starts running at 100% and the</div> <div>> > user is unable to login. </div> <div>> > 4. Only way to get the process back to normal is to type "service</div> <div>> > ipa restart"</div> <div>> </div> <div>> > </div> <div>> > I've never debugged a program before so if I'm missing a step please </div> <div>> > let me know.</div> <div>> </div> <div>> Ok, let's simplify the problem first.</div> <div>> </div> <div>> apperently you have a quadcore cpu so by default we configured krb5kdc to spawn 4 worker processes. Let's bring it down to not spawning any worker process so we can simplify debugging.</div> <div>> </div> <div>> Go to /etc/sysconfig/krb5kdc and remove the "-w 4" argument from it.</div> <div>> </div> <div>> Then simply do a service krb5kdc restart (no need to restart the whole ipa service for this).</div> <div>> </div> <div>> </div> <div>> If krb5kdc locks up again, gdb the process like you have done before but do not press c, type 'bt' instead and copy the log then you can exit gdb.</div> <div>> </div> <div>> Simo.</div> <div>> </div> <div>> </div> <div>> _______________________________________________</div> <div>> Freeipa-users mailing list</div> <div>> <a href="mailto:Freeipa-users@redhat.com"><font color="blue"><u>Freeipa-users@redhat.com</u></font></a></div> <div>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users"><font color="blue"><u>https://www.redhat.com/mailman/listinfo/freeipa-users</u></font></a></div> <div> </div> <div>--</div> <div>Simo Sorce * Red Hat, Inc * New York</div> <div> </div> <div> </div> </span></font> </body> </html>