<div dir="ltr">Eureka!<div><br></div><div style>Someone had deleted the contents of /etc/dirsrv/slapd-PKI-IPA/dse.ldif. I replaced it from a saved copy and now everything's working as expected.</div><div style><br>Thanks everyone for your contributions, patience, and indulgence. And for a wonderful product!</div>
</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><a href="http://damascusgrp.com/" target="_blank"><img src="http://damascusgrp.com/uploads/3/2/2/6/3226794/6425940.png" width="200" height="52"></a><br>
</div><div><a href="http://bretwortman.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://twitter.com/BretWortman" target="_blank">http://twitter.com/BretWortman</a></div></div></div>
<br><br><div class="gmail_quote">On Wed, Feb 20, 2013 at 9:34 AM, Bret Wortman <span dir="ltr"><<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@damascusgrp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">I think this keeps coming back to the fact that ldap isn't listening on 7389 for some reason. When I try to <i>really</i> manually start pki-ca like this, it complains about ldap before dying:<div><br></div>
<div><font face="courier new, monospace"># sudo -u pkiuser -s /usr/lib/jvm/jre/bin/java -classpath :/usr/share/tomcat6/bin/bootstrap.jar:/usr/share/tomcat6/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/var/lib/pki-ca -Dcatalina.home=/usr/share/tomcat6 -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat6/temp -Djava.util.logging.config.file=/var/lib/pki-ca/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start</font></div>
<div>:</div><div>:</div><div><font face="courier new, monospace">Could not connect to LDAP server host <a href="http://oldmaster.my.com" target="_blank">oldmaster.my.com</a> port 7389 Error netscape.ldap.LDAPException: failed to connect to server ldap://<a href="http://oldmaster.my.com:7389" target="_blank">oldmaster.my.com:7389</a> (91)</font></div>
<div><font face="courier new, monospace">[root@oldmaster]#</font></div><div><br></div><div>This bears out what I see in /var/log/pki-ca/catalina.out too.</div><div><br></div></div><div class="gmail_extra"><div class="im">
<br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><a href="http://damascusgrp.com/" target="_blank"><img src="http://damascusgrp.com/uploads/3/2/2/6/3226794/6425940.png" width="200" height="52"></a><br>
</div><div><a href="http://bretwortman.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://twitter.com/BretWortman" target="_blank">http://twitter.com/BretWortman</a></div></div></div>
<br><br></div><div><div class="h5"><div class="gmail_quote">On Wed, Feb 20, 2013 at 8:43 AM, Bret Wortman <span dir="ltr"><<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@damascusgrp.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>On Wed, Feb 20, 2013 at 8:40 AM, Simo Sorce <span dir="ltr"><<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>></span> wrote:<br></div><div class="gmail_extra"><div class="gmail_quote">
<div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>On Wed, 2013-02-20 at 08:08 -0500, Bret Wortman wrote:<br>
> Digging further into my logs this morning, I've discovered that<br>
> there's no new entries in /var/log/dirsrv/slapd-PKI-IPA since Feb 5<br>
> either. How can I tell why this isn't<br>
> running? /var/log/dirsrv/slapd-MY-COM is getting updated and logged<br>
> to, it's just the PKI piece that seems to be dead.<br>
><br>
><br>
> Nothing in /etc/pki-ca has changed since last year, and the last<br>
> updates to /var/lib/dirsrv/slapd-PKI-IPA/db or changelogs occurred on<br>
> Feb 5. I just can't tell what that change was....<br>
<br>
</div>What error do you get if you try to start it ?<br>
<div></div></blockquote><div><br></div></div><div><div><div dir="ltr" style="font-family:arial,sans-serif;font-size:13px"><div><font face="courier new, monospace">[root@oldmaster]# pkicontrol start ca PKI-IPA</font></div>
<div><font face="courier new, monospace">PKI-IPA is an invalid 'pki-ca' instance</font></div><div><font face="courier new, monospace">[root@oldmaster]#</font></div></div><div style="font-family:arial,sans-serif;font-size:13px">
</div></div><div><br></div></div><div>Is there another, preferred way to start it?</div><div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>><br>
> Would a key change or certificate change have affected this?<br>
<br>
</div>An expired CA cert might cause the server to stop, but then you would<br>
see expired certs all over and also the main IPA instance would not<br>
start.<br>
<div>><br>
> Worst case, if I do something like this:<br>
><br>
><br>
> # ipa-server-install -U --uninstall<br>
> # ipa-server-install<br>
><br>
</div>You will completely obliterate all your data.<br>
<div><br>
> will I lose the hosts, policies & users I already have configured?<br>
> Does this stand a chance of getting me back up to where I can clone<br>
> this box and get healthy again?<br>
><br>
</div>Healthy will be, but with no data, don't do it. (and I suggest you make<br>
a full backup just in case)<br>
<span><font color="#888888"><br>
Simo.<br>
<br>
--<br>
Simo Sorce * Red Hat, Inc * New York<br>
<br>
</font></span></blockquote></div></div><br></div></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div>